Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to make a decision of what computer is behind the firewall sending the packet.

Imagine I have 2 PCs behind the firewall and I want to, based on (my algorithm), make a decision at the firewall level, before doing the NAT. Basically intercept the packet, then make the decision, how can I do that?

What tool should I use to write my custom C code to perform that operation.

share|improve this question

It's unclear if you want to actually act on the data in the packet or just route it based on which computer sent it?

iptables can do the routing, and it's pretty sophisticated. It makes use of what are called "tables", ironically, and so you can interrogate and re-route the data as it passes through the various "tables".

See this tutorial for more info: http://wiki.centos.org/HowTos/Network/IPTables.

There are 3 primary tables but more can be added via plugins/modules and also custom ones can be developed too.

The primary ones:

  • Input
  • Forward
  • Output

So as a packet comes into the box it would pass through the "Input" table where it can be acted on. As packets flow out of the box they flow through the "Output" table and can be acted on their as well.

Take a look at this tutorial for more info on iptables.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.