netfilter&firewalld iptables 學習路線

netfilter

firewalled

iptables

iptables命令格式

iptables過濾條件

包過濾防火牆工作原理

技術原理

資料包的核心路徑圖

Netfilter是Linux 2.4.x引入的一個子系統，它作為一個通用的、抽象的框架，提供一整套的hook函式的管理機制，使得諸如資料包過濾、網路地址轉換(NAT)和基於協議型別的連線跟蹤成為了可能。
netfilter的架構就是在整個網路流程的若干位置放置了一些檢測點（HOOK），而在每個檢測點上登記了一些處理函式進行處理。

netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack.

iptables is a generic table structure for the definition of rulesets. Each rule within an IP table consists of a number of classifiers (iptables matches) and one connected action (iptables target).

netfilter, ip_tables, connection tracking (ip_conntrack, nf_conntrack) and the NAT subsystem together build the major parts of the framework.

Main Features

stateless packet filtering (IPv4 and IPv6)
stateful packet filtering (IPv4 and IPv6)
all kinds of network address and port translation, e.g. NAT/NAPT (IPv4 and IPv6)
flexible and extensible infrastructure
multiple layers of API’s for 3rd party extensions
What can I do with netfilter/iptables?

build internet firewalls based on stateless and stateful packet filtering
deploy highly available stateless and stateful firewall clusters
use NAT and masquerading for sharing internet access if you don’t have enough public IP addresses
use NAT to implement transparent proxies
aid the tc and iproute2 systems used to build sophisticated QoS and policy routers
do further packet manipulation (mangling) like altering the TOS/DSCP/ECN bits of the IP header

iptables傳輸資料包的過程

!

!

!

!

生產案例

引用