next up previous
Next: Managing firewall filters Up: Linux firewall facilities for Previous: IP packet filtering

Kernel filtering scheme

The Linux kernel provides native support for IP packet filtering at several stages: when a packet is received, when packet is sent, and when a packet is being forwarded (see figure 1).

Figure 1

Each of the three filters consists of a default policy and a list of filter rules. Every filter rule defines some packet characteristics, like IP addresses, an optional network device, and several other options. Furthermore, each rule has a policy associated with it, defining what to do when a packet matches with the rule.

The algorithm used in the filters can be described as follows:

  1. Step through the list of filter rules associated with the filter and check whether the packet matches with the rule or not.
  2. The first matching filter rule (if any) determines all further actions:
  3. If none of the filter rules match with the packet, use the default policy associated with the filter.

There are currently three policies supported in Linux:

Filter rules in Linux contain the following items:

Now that we have seen the basic concepts of the Linux firewall filters, we will show how to manage the filter rules from an administrator point of view.


next up previous
Next: Managing firewall filters Up: Linux firewall facilities for Previous: IP packet filtering

Note that this paper is based on Linux 1.3.88 and ipfwadm 2.0, describing the situation in April 1996.
A revision of this paper for Linux 2.0.x and ipfwadm 2.3.0 is planned, but not yet available.

Copyright © 1996 by X/OS Experts in Open Systems BV. All rights reserved.

ÿÿÿ