The New System: Netfilter
[0] raw (config option, may be wiped, allows promisc accounting).
[1] pre-routing (demasquerade, reverse NAT, redirect)
[2] input (packet filtering)
[3] forward (packet filtering)
[4] output (packet filtering, demasq, reverse NAT, redirect)
[5] post-routing (masquerade, de-reverse NAT)
- Each hook can be registered for by multiple modules. First in,
first called.
- Can return NF_DROP, NF_ACCEPT or NF_USERSPACE.
- The next hook on that hook point called unless NF_DROP returned.
- Caching bitfield indicates what that hook examined, and if it
changed the packet.
- nf_drop() call for registering packet drops (eg. in routing
code).
Packet Filtering
- New filtering tool and extensible module called `ip_tables.o'; uses
hooks 2, 3, and 4.
- Example modules: REJECT module (sends ICMP port unreachable and
returns NF_DROP), and MAC module (compares MAC address).
- Loads whole tables instead of individual rules.
- Smaller than ipchains.
- Knows nothing about packet manipulation (eg. masquerading, NAT or
redirection).
Masquerading/NAT
NAT: Network Address Translation
- Alter source IP to make outgoing packets appear to come from
somewhere else.
- Alter destination IP of incoming replies to return to original
source.
NAPT: Network Address Port Translation
- As above, but with awareness of protocols, so we can shuffle
source ports to overload multiple IPs onto one IP.
- We don't differentiate between NAT and NAPT: we always to NAPT
where we need to, and understand the protocol.
Masquerading
- As above, but source IP used is IP address of the interface
the packet is being routed to.
RNAT: Reverse NAT
- Alter destination IP of incoming packets to direct it to real
server.
- Alter source IP of replies to come from where the client expects.
- Exactly the same as NAT, but connection setup is initiated by
an "incoming" not "outgoing" packet.
- New NAT infrastructure uses hooks 1, 2, 4 and 5.
- Provides understanding of ICMP, TCP and UDP by default.
- Modules can be written for other protocols, or they can be
handled as "black boxes" (breaks most protocols).
- Different "mapping" modules can be written, which modify how
the mapping to a range of addresses is done
- masquerade
- redirect
- failover?
- UDP and TCP allow modules to provide extra handling for certain
destination ports, eg. FTP, realaudio.
- An ordered (most-specific to least-specific) setup table is kept,
which is manipulated by userspace. When a match is found in this
table, the mapping type module is called to create a "binding".
Next