IPTables are the basic and very commonly used firewall in Linux systems. netfilter provides 5 hooks that programs can register with.

which layer does Netfilter and IPTables works on?

  • IP Packet level
  • TCP/UDP Packet Level

enter image description here

1 Answer 1


There is not going to be a simple answer, as nftables/iptables acts on multiple layers of these models.

The most basic ip[6]tables rules (or ip, ip6 and inet address families for nftables) mostly act on the OSI network layer (Internet layer on TCP/IP model). But arptables and ebtables (or the arp, bridge and netdev address families for nftables) will operate on the OSI data-link layer, and even basic ip[6] tables is at least aware of which datalink (physical interface, aggregation or a virtual interface) is being used.

For any rules that include a protocol specification (for ip[6]tables, anything including a -p option; for nftables, anything with the protocol keyword) will operate on the transport layer too.

If connection tracking is involved, that implies at least awareness of the OSI session layer; anything implementing NAT will definitely manipulate the session layer information, and if protocol-specific NAT modules (= modules like nf_nat_ftp) are used, they may reach as high into the OSI presentation/application layers as required for that particular protocol/application.

So you could say that nftables (or the combination of iptables + arptables + ebtables) can affect just about any OSI layer except the physical one.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .