<< Back to article

netfilter, firewall, conntrack, masquerade

netfilter is the Linux kernel's packet filtering and NAT framework. It provides the foundation for firewalls, network address translation, and packet mangling. The iptables/nftables user-space utilities configure netfilter rules.

Architecture

Netfilter hooks into the kernel network stack at five points (chains):

  • PREROUTING: Incoming packets before routing decision.
  • INPUT: Packets destined for local processes.
  • FORWARD: Packets being routed through the host.
  • OUTPUT: Packets generated locally.
  • POSTROUTING: Outgoing packets after routing decision.

Tables group related functionality:

  • filter: Default table for packet filtering (firewall rules).
  • nat: Network Address Translation (masquerade, DNAT, SNAT).
  • mangle: Packet modification (TOS, mark, TTL).
  • raw: Connection tracking exemption.
  • security: Mandatory Access Control (SELinux).

iptables vs nftables

  • iptables: Legacy tool, stable, widely documented. Uses separate binaries for IPv4 (iptables) and IPv6 (ip6tables).
  • nftables: Modern replacement, single framework for IPv4 and IPv6, simpler syntax, better performance.

Most modern distributions support both. iptables-nft provides an iptables-compatible frontend to nftables.

Basic Firewall Rules (iptables)

List Rules

iptables -L -v -n             # List with counters
iptables -t nat -L -v -n      # NAT table

Default Policy

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

Allow SSH

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Allow Established Connections

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Connection Tracking (conntrack)

The nf_conntrack module tracks the state of network connections. It allows the firewall to distinguish new connections from established ones.

View the connection table:

cat /proc/net/nf_conntrack
conntrack -L                   # Using conntrack-tools

Common states:

  • NEW: First packet of a connection.
  • ESTABLISHED: Part of an existing connection.
  • RELATED: New connection related to an existing one (e.g., FTP data connection).
  • INVALID: Packet cannot be tracked.
  • UNTRACKED: Bypassed connection tracking.

NAT and Masquerade

Source NAT (SNAT)

SNAT changes the source address of outgoing packets, typically to the public IP of the gateway:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Masquerade is a special form of SNAT that automatically uses the outgoing interface's IP address.

Destination NAT (DNAT)

DNAT changes the destination address of incoming packets, typically for port forwarding:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.20:80

nftables Example

Modern systems use nftables. A simple nftables configuration:

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        ct state established,related accept
        iif lo accept
        tcp dport 22 accept
        icmp type echo-request accept
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}