Skip to content

Netfilter & nftables

The Linux kernel's Netfilter framework provides the foundation for packet filtering, NAT, and traffic control. It operates through a series of hooks embedded in the networking stack, allowing user-space tools like iptables and nftables to inspect, modify, and direct network traffic. This section explores Netfilter hooks, rule management with iptables/nftables, and packet modification techniques for advanced traffic control.

Netfilter Hooks and Packet Flow

Netfilter integrates into the Linux networking stack at predefined "hooks" where packets can be inspected and modified. These hooks are organized into tables (e.g., filter, nat, mangle) and chains (e.g., INPUT, FORWARD, OUTPUT). Each hook corresponds to a stage in the packet processing pipeline:

Incoming Traffic (PREROUTING → INPUT)

  • PREROUTING: Early stage for NAT (e.g., DNAT for incoming connections).
  • INPUT: Final stage for packets destined for local processes.

Outgoing Traffic (OUTPUT → POSTROUTING)

  • OUTPUT: Final stage for packets generated by local processes.
  • POSTROUTING: Early stage for NAT (e.g., SNAT for outgoing connections).

Forwarded Traffic (FORWARD)

  • FORWARD: Processed for packets routed through the system (e.g., in a router).

These hooks enable rules to be applied at specific points in the network stack, allowing granular control over traffic.

iptables vs. nftables: Rule Management

iptables (Legacy)

  • Tables: filter (filtering), nat (NAT), mangle (packet modification).
  • Chains: Defined in tables (e.g., INPUT, OUTPUT).
  • Syntax: Verbose, with separate commands for each table.
  • Example: Block traffic on port 80: 
    iptables -A INPUT -p tcp --dport 80 -j DROP

nftables (Modern)

  • Tables: Unified structure with filter, nat, mangle, etc.
  • Chains: Defined within tables, with more flexible rule ordering.
  • Syntax: Concise, with a single nft command for all operations.
  • Example: Block port 80: 
    nft add rule ip filter INPUT tcp dport 80 counter drop

Key Differences: - nftables supports more complex rules (e.g., set-based filtering) and is more efficient for high-throughput environments. - iptables is still widely used for legacy systems but lacks the scalability of n.

Packet Modification with Netfilter

Netfilter allows packet modification via the mangle table, enabling tasks like QoS, traffic shaping, and packet marking. This is achieved using extensions like TPROXY, MARK, and CONNTRACK.

Example: Marking Packets for QoS

# Mark packets from 192.168.1.0/24 with priority 10
iptables -t mangle -A PREROUTING -s 192.168.1.0/24 -j MARK --set-mark 10

Example: Using nftables for Advanced Marking

nft add rule ip mangle PREROUTING ip saddr 192.168.1.0/24 meta mark set 10

These modifications are applied before routing decisions, enabling policies like prioritizing certain traffic in a classifier (e.g., with tc tools).

Troubleshooting and Best Practices

  1. Rule Order Matters: Rules are evaluated in the order they are added. Place specific rules before general ones.
  2. Use iptables-save/nft list: Inspect current rules to debug conflicts or unintended behavior.
  3. Test in Isolation: Validate rules in a controlled environment before deploying to production.
  4. Monitor Kernel Logs: Use dmesg or journalctl to catch errors during rule application.
  5. Avoid Overloading Chains: Split complex rules into separate chains for clarity and performance.

Key takeaways

  • Netfilter hooks enable precise control over packet processing at critical stages in the network stack.
  • iptables and nftables offer different trade-offs in syntax, scalability, and flexibility; nftables is preferred for modern systems.
  • Packet modification via the mangle table is essential for advanced traffic shaping and QoS.
  • Rule order, testing, and logging are critical for effective Netfilter configuration.