What if we want to drop some packets arriving to a.out process? For example, we might dislike packets with one particular source IP address, because we suspect this IP belonging to a malicious user. Now, let's get back to our primary task - packets filtration and/or alteration. In fact, Linux network stack does provide such logical separation of stages. When I say a network stack here I just mean a bunch of layers provided by the Linux kernel to handle the network data transmission and receiving. What is the commonality amongst all those scenarios? Basically, all of them describe pavings of the packets' ways from a network interface through the network stack to a user space process (or another interface) and turnarounds.

When packets get created, what are their paths inside of the kernel, what are their origins and destinations, etc? Have a look at the following scenarios:Ī packet arrives to the network interface, passes through the network stack and reaches a user space process.Ī packet is created by a user space process, sent to the network stack, and then delivered to the network interface.Ī packet arrives to the network interface and then in accordance with some routing rules is forwarded to another network interface. but before trying to make an impact on a happy life of packets in the kernel space, let's try to understand their universe. For this, iptables provides a special syntax to encode different packets-affecting rules. Or the deepest - packets modification! And maybe you've heard, that everything is happening on the kernel side, without user space code involved. Probably, you already know that iptables has something to do with IP packets. By the way, the first time I faced this tool I was pretty much confused by the terminology too!

I would rather try to use layman's terms and scribbling as much as possible to give you some insights about the domain before going to all these tables, rules, targets, and policies. I'm not going to put either formal and boring definitions here nor long lists of useful commands. Gee, it's my turn to throw some gloom light on iptables! There are hundreds or even thousands of articles on the topic out there, including introductory ones.

Substance 3d designer 2021