Linux: What's Netfilter, iptables, Their Differences?

What is netfilter, iptables, their differences?

the netfilter home page at http://www.netfilter.org/ gives good answers.

Quote:

netfilter is the packet filtering framework inside the Linux 2.4.x and later kernel series. Software commonly associated with netfilter is iptables.

Software inside this framework enables packet filtering, network address [and port] translation (NA[P]T) and other packet mangling. …

netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack.

iptables is a generic table structure for the definition of rulesets. Each rule within an IP table consists of a number of classifiers (iptables matches) and one connected action (iptables target).

netfilter, ip_tables, connection tracking (ip_conntrack, nf_conntrack) and the NAT subsystem together build the major parts of the framework.

Main Features

• stateless packet filtering (IPv4 and IPv6)
• stateful packet filtering (IPv4 and IPv6)
• all kinds of network address and port translation, e.g. NAT/NAPT (IPv4 and IPv6)
• flexible and extensible infrastructure
• multiple layers of API's for 3rd party extensions

What can I do with netfilter/iptables?

• build internet firewalls based on stateless and stateful packet filtering
• deploy highly available stateless and stateful firewall clusters
• use NAT and masquerading for sharing internet access if you don't have enough public IP addresses
• use NAT to implement transparent proxies
• aid the tc and iproute2 systems used to build sophisticated QoS and policy routers
• do further packet manipulation (mangling) like altering the TOS/DSCP/ECN bits of the IP header

so, in short, “netfilter” is the firewall framework for Linux. It consists of many modules. “iptables” is a primary module.

here's a bit from Wikipedia:

iptables are the tables provided by the Linux kernel firewall (implemented as different Netfilter modules) and the chains and rules it stores. Different kernel modules and programs are currently used for different protocols; iptables applies to IPv4, ip6tables to IPv6, arptables to ARP, and ebtables to Ethernet frames.

note: arptables and ebtables are not installed by default. You can apt-get to intsall them.

now, you might also have heard of ipchains. It is the predecessor of iptables. Here's a summary of history:

• ipfw on FreeBSD. Still used today in FreeBSD.
• “ipfwadm” in Linux 2.0 (1996). This is based on “ipfw”.
• ipchains, Linux 2.2 (1999). By Rusty Russell.
• iptables, 1998. By Rusty Russell.

what's the diff between ufw and iptables?

• ufw is a command line program for setting up firewall.
• The ufw project's full name is Uncomplicated Firewall.
• ufw is a simplified frontend to iptables.

more detail at ufw home page at: https://wiki.ubuntu.com/UncomplicatedFirewall. Quote:

The Linux kernel in Ubuntu provides a packet filtering system called netfilter, and the traditional interface for manipulating netfilter are the iptables suite of commands. iptables provide a complete firewall solution that is both highly configurable and highly flexible.

Becoming proficient in iptables takes time, and getting started with netfilter firewalling using only iptables can be a daunting task. As a result, many frontends for iptables have been created over the years, each trying to achieve a different result and targeting a different audience.

The Uncomplicated Firewall (ufw) is a frontend for iptables and is particularly well-suited for host-based firewalls. ufw provides a framework for managing netfilter, as well as a command-line interface for manipulating the firewall. ufw aims to provide an easy to use interface for people unfamiliar with firewall concepts, while at the same time simplifies complicated iptables commands to help an adminstrator who knows what he or she is doing. ufw is an upstream for other distributions and graphical frontends.