IP Tables / netfilters and modules

Question

I am trying to understand how firewall works in linux... I have read documentation but i am not sure about some things....

Netfilters is included in the modern kernels which allows you using hooks to monitor packages without changing their content.

Iptables they say that it is a software that uses netfilter and ip_tables module maybe..
My questions are....

• Does IPTables userspace software register any hook ?
• What does ip_table module do?
• Who does the processing iptables or the module ?
• What things IPtable do ?(Just manages the rules in memory?? or it has hooks and proccesses the traffic?)?

Answer 1

netfilter

netfilter is a set of hooks sprawled throughout the networking code in the kernel. This means that if a piece of code is about to do something significant (we'll call it X), it calls a function that says "I'm about to do X". That function would then notify any other interested parties via a registered callback. It is also used by other (not iptables) systems like IPVS.

netfilter also includes mechanisms for passing packets to userspace programs - this is used by iptables for the QUEUE and ULOG targets to allow the user to process packets in userspace.

ip_tables (the kernel module)

ip_tables is a module that uses netfilter to get these notices. It identifies packets that it has been told are relevant and does actions it was told to do. It knows which packets are relevant and the actions to perform on them based on rules that the user has given it; it stores these rules in a table. In fact, it uses a more generic module, xtables, that ip_tables uses.

Extension modules

Extension modules do much of the work of providing match criteria and target actions. Some examples of extension modules include IP_NF_TARGET_LOG and NF_NAT.

iptables (the userspace tool)

iptables is a userspace tool for setting up those rules in the ip_tables module. The tool also comes with many plugins that parse command-line options and register rules.

Learn more about iptables internals

If you want to learn more of the internals, there is an excellent book about it. The book has all you need if you want to create additional functionality for iptables, but will not do much to further your understanding of how to use iptables.

Learn more about using iptables

If you want to better understand how to use iptables, it is better to read several different pieces of documentation to see things explained in different ways. Even more important, is to play with iptables yourself. I particularly appreciated using the LOG target to see the flow of packets through the tables and chains and the effects of the rules on them. Additionally, a chart of the packet flow through the tables is extremely useful. Finally, if you're trying to do something with iptables and it's not doing what you expect, ask a specific question here on the site; there are a number of people who regularly answer questions who are familiar with iptables.

Answer 2

First, understand that in Linux, TCP/IP sending, receiving, and forwarding are done in the kernel. So everything networking related is kernel modules that either have to be built into the kernel or modprobed after boot.

Quoting from http://www.netfilter.org/: "netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack."

What this means is that Netfilter is just a bunch of "openings" in the kernel that lets someone create and plug-in other code that changes how Linux does anything related to networking.

Further from the article: "iptables is a generic table structure for the definition of rulesets. Each rule within an IP table consists of a number of classifiers (iptables matches) and one connected action (iptables target)."

iptables is a specific project and a set of kernel modules that takes advantage of the the "openings" provided by Netfilter to implement rule-by-rule based packet filtering (also known as firewalling) and a lot more.

So iptables will 1) hook itself into Netfilter, and intercept network packets the kernel was either about to send to a NIC or send to an application, and 2) process this packet against each of its current set of rules and 3) when a rule matches, send the packet to that rule's target.

With properly configured rules you can then drop certain packets coming in from the NIC, change packets to implement NAT or port redirection, or just take action depending on protocol-specific content of the packet, or the payload contents of the packet. You can also write rules that hand the packet to a userspace application (this is the NFQUEUE target) for further processing (userspace-based filters like moblock use this).

I'm not a Linux kernel expert, but I believe there's one main iptables module that handles adding/deleting rules and this is what the iptables user space application talks to. Pretty much every target is then handled by its own kernel module that can either exist as a separate module or be built into the kernel.

You can look for yourself. Download a kernel from www.kernel.org, un-bzip2-it, cd into its directly and do a make menuconfig. Drill down starting with "Networking Support" and you'll be able to see all the modules available for iptables.

Answer 3

The iptables command only manipulates the kernel's packet filtering rules. Network traffic is normally entirely managed by the kernel, according to these rules. The kernel can do pretty sophisticated routing and monitoring. In addition to iptables, the iproute2 collection of utilities is necessary to control the kernel's behavior in advanced scenarios.

The ip_tables module (there's no ip_table module) is one part of the kernel packet handling component. Unless you're developing kernel networking code or installing custom patches from people who're doing that, you don't need to care which module is doing exactly what.

It's possible to call user-space code when a packet is received. This corresponds to very specific filtering, mangling, routing or logging needs. The kernel has hooks to run user-space code on certain events, and the netfilter userspace libraries provide an interface to these hooks.