Linux Networking — Netfilter

Introduction

Netfilter, introduced in Linux 2.3, is an essential component for packet processing. It is a framework consisting of kernel hooks that enable userspace applications to manage packets on behalf of the kernel.

In essence, an application registers itself to a specific Netfilter hook, and the kernel invokes that application for the relevant packets. The application can then instruct the kernel to perform an action on the packet (such as dropping it) or return a modified packet to the kernel.

This allows developers to create regular userspace applications that handle packet processing. Netfilter was developed alongside iptables, with the aim of separating kernel and userspace code.

For example, you use the iptables command to create a rule that tells the kernel to drop packets coming from this IP address:

$ sudo iptables -A INPUT -s 192.0.2.100 -j DROP

• -A appends a new rule to the chain.
• INPUT is the chain name in which the new rule will be added.
• -s specifies the source IP address.
• 192.0.2.100 is the source IP address to be blocked.
• -j specifies the action to be taken.
• DROP is the action to drop the packets from the…