xxxx

What is netfilter.org?

netfilter.org is home to the software of the packet filtering framework inside the Linux 2.4.x and later kernel series. Software commonly associated with netfilter.org is iptables.

Software inside this framework enables packet filtering, network address [and port] translation (NA[P]T) and other packet mangling. It is the re-designed and heavily improved successor of the previous Linux 2.2.x ipchains and Linux 2.0.x ipfwadm systems.

netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack.

iptables is a generic table structure for the definition of rulesets. Each rule within an IP table consists of a number of classifiers (iptables matches) and one connected action (iptables target).

netfilter, ip_tables, connection tracking (ip_conntrack, nf_conntrack) and the NAT subsystem together build the major parts of the framework.

linux 2.4内核以后内核里都包含“包过滤器框架”这个软件，通常与netfilter关联的软件是iptables

软件框架的内部允许包过滤，地址和端口转换和其他包映射。它对之前llinux2.2系列的ipchains和linux2.0系列的ipfwadm系统做了重大改进和重设计。

netfilter是一组linux内核内的钩子，它允许内核模块注册钩子函数到网络栈。网络栈的每个消息包穿越时注册的钩子函数被调用。

iptables是一个表结构，定义规则组，IP表的每条规则包含很多类过滤和一个连接动作。

netfilter iptables connection tracking 和nat子系统是框架的主要组成子系统。

Main Features

• stateless packet filtering (IPv4 and IPv6)
• stateful packet filtering (IPv4 and IPv6)
• all kinds of network address and port translation, e.g. NAT/NAPT (IPv4 and IPv6)
• flexible and extensible infrastructure
• multiple layers of API's for 3rd party extensions

主要特性

无状态的包过滤器支持ipv4 ipv6

有状态的包过滤器 支持ipv4 ipv6

支持所有种类的网络地址和端口转发

灵活的和可扩展的基础架构

3层

What can I do with netfilter/iptables?

• build internet firewalls based on stateless and stateful packet filtering
• 构建网络防火墙基于有状态和无状态的包过滤器
• deploy highly available stateless and stateful firewall clusters
• 
  
  部署高度可用的无状态和状态防火墙集群
  
• use NAT and masquerading for sharing internet access if you don't have enough public IP addresses
• use NAT to implement transparent proxies
• aid the tc and iproute2 systems used to build sophisticated QoS and policy routers
• do further packet manipulation (mangling) like altering the TOS/DSCP/ECN bits of the IP header

部署高度可用的无状态和状态防火墙集群
我可以用netfilter / iptables做什么？


构建基于无状态和状态包过滤的互联网防火墙
部署高度可用的无状态和状态防火墙集群
如果您没有足够的公网IP地址，请使用NAT和伪装共享互联网访问
使用NAT实现透明代理
用于构建复杂的QoS和策略路由器的 帮助tc和iproute2系统
进行进一步的数据包处理（调整），如更改IP报头的TOS / DSCP / ECN位