Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
It is said that kernel responsible for the transport, internet and network access layers for a network data. Then, the network data is passed on the appropriate process based on port number.
How security programs like firewall, IPS and IDS have access to network data that do not belong them while they are just user level program and not part of kernel? How about proxy server?
How come the network data has to pass the firewall first before the appropriate process?
Generally, those security programs contain two parts, one running in kernel space, one running in user space. The user space part is only an interface to iteract with kernel space part.
For example, iptables contains:
netfilter, a set of hooks to the networking code in the kernel. It also includes mechanisms for passing packets to user space program.
ip_tables, a module that uses netfilter to troubleshoot the
network packets, set up rules...
iptables, a user space tool for setting up rules in the
ip_tables module.
Netfilter and ip_iptables run in kernel space while iptables run in user space.
netfiilter documentation or source and try to understand how it work, or how netfilter hook into the kernel.
FreeBSD yet, but google give me: freebsd.org/doc/en/articles/linux-users/firewall.html