It is said that kernel responsible for the transport, internet and network access layers for a network data. Then, the network data is passed on the appropriate process based on port number.

How security programs like firewall, IPS and IDS have access to network data that do not belong them while they are just user level program and not part of kernel? How about proxy server?

How come the network data has to pass the firewall first before the appropriate process?

1 Answer 1


Generally, those security programs contain two parts, one running in kernel space, one running in user space. The user space part is only an interface to iteract with kernel space part.

For example, iptables contains:

  • netfilter, a set of hooks to the networking code in the kernel. It also includes mechanisms for passing packets to user space program.

  • ip_tables, a module that uses netfilter to troubleshoot the network packets, set up rules...

  • iptables, a user space tool for setting up rules in the ip_tables module.

Netfilter and ip_iptables run in kernel space while iptables run in user space.

  • I do have experience with iptables and have read about Netfilter on Wikipedia but it is still unclear to me. How the security programs (process) receive the network data that are not supposed for them?
    – Ron Vince
    Apr 2, 2014 at 5:48
  • I think you should read through the netfiilter documentation or source and try to understand how it work, or how netfilter hook into the kernel.
    – cuonglm
    Apr 2, 2014 at 5:56
  • It seems like netfilter is for Linux kernel. How about FreeBSD?
    – Ron Vince
    Apr 2, 2014 at 8:42
  • I haven't used FreeBSD yet, but google give me: freebsd.org/doc/en/articles/linux-users/firewall.html
    – cuonglm
    Apr 2, 2014 at 8:45
  • Somehow I missed to mention something in the previous answer. How netfilter is connected to transport layer, internet layer and network access layer in kernel? How is it connected to application layer? netfilter is for Linux kernel. Somehow I have not found relevant documents. How about FreeBSD?
    – Ron Vince
    Apr 2, 2014 at 9:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .