Difference between revisions of "Netfilter hooks"

From nftables wiki
Jump to navigation Jump to search
Line 27: Line 27:


                                                         Local process
                                                         Local process
                                                            ^  |    .-----------.
                                                          ^  |    .-----------.
                                  .-----------.              |  |    |  Routing  |
                                .-----------.              |  |    |  Routing  |
                                  |          |-----> input /  \--->|  Decision |------> output --
                                |          |-----> input /  \--->|  Decision |---> output --
  --> ingress ---> prerouting ---> |  Routing  |                      .-----------.                 \
  --> ingress --> prerouting --> |  Routing  |                      .-----------.             \
                                  | Decision  |                                                     --> postrouting -->
                                | Decision  |                                                 --> postrouting -->
                                  |          |                                                   /
                                |          |                                                 /
                                  |          |---------------> forward ---------------------------
                                |          |---------------> forward ------------------------
                                  .-----------.
                                .-----------.


You can use this new ingress hook to filter traffic from Layer 2, this new hook come earlier than prerouting. This basically provides an alternative to '''tc'''.
You can use this new ingress hook to filter traffic from Layer 2, this new hook come earlier than prerouting. This basically provides an alternative to '''tc'''.

Revision as of 02:21, 2 November 2017

If you are familiar with Netfilter, don't worry, most of the infrastructure remains the same. nftables reuses the existing hook infrastructure, Connection Tracking System, NAT engine, logging infrastructure, userspace queueing and so on. Therefore, we have only replaced the packet classification framework.

For those unfamiliar with Netfilter, we provide ASCII art to represent our hooks:

                                             Local
                                            process
                                              ^  |      .-----------.
                   .-----------.              |  |      |  Routing  |
                   |           |-----> input /    \---> |  Decision |----> output \
--> prerouting --->|  Routing  |                        .-----------.              \
                   | Decision  |                                                     --> postrouting
                   |           |                                                    /
                   |           |---------------> forward --------------------------- 
                   .-----------.

Basically, traffic flowing to the local machine in the input path see the prerouting and input hooks. Then, the traffic that is generated by local processes follows the output and postrouting path.

If you configure your Linux box to behave as router, do not forget to enable forwarding via:

echo 1 > /proc/sys/net/ipv4/ip_forward

And then, the packets that are not addressed to your local system will be seen from the forward hook. In summary, packets that are not addressed to local processes follow this path: prerouting, forward and postrouting.

Ingress hook

Since Linux kernel 4.2, Netfilter also comes with an ingress hook that you can use from nftables. So the big picture now look like this:

                                                       Local process
                                                          ^  |    .-----------.
                               .-----------.              |  |    |  Routing  |
                               |           |-----> input /   \--->|  Decision |---> output --
--> ingress --> prerouting --> |  Routing  |                      .-----------.              \
                               | Decision  |                                                  --> postrouting -->
                               |           |                                                 /
                               |           |---------------> forward ------------------------
                               .-----------.

You can use this new ingress hook to filter traffic from Layer 2, this new hook come earlier than prerouting. This basically provides an alternative to tc.