4 ms·
This place needs more of this kind of documentation. I failed to use IP tables for years. I bought books. I copied recipes from blog posts. Nothing made sens
by elevation 1y ago
This place needs more of this kind of documentation.
I failed to use IP tables for years. I bought books. I copied recipes from blog posts. Nothing made sense, everything I did was brittle. Until I finally found a schematic showing the flowchart of a packet through the kernel, which gives the exact order that each rule chain is applied, and where some of the sysctl values are enforced. All of a sudden, I could write rules that did exactly what I wanted, or intelligently choose between rules that have equivalent behaviors in isolation but which could have different performance implications.
After studying the schematic, every would just work on the first try. A good schematic makes a world of difference!
- HotGarbage 1y agoWas it this one? https://en.wikipedia.org/wiki/File%3aNetfilter-packet-flow.svg https://en.wikipedia.org/wiki/File%3aNetfilter-packet-flow.s...
- suprjami 1y agoOne of my favourite webpages. Have used it countless times over the years.
- UltraSane 1y agoI use this all the time when writing iptable rules.
- immibis 1y agoThis also isn't complete because it doesn't show code between or around the various tables. I used to think of iptables as dumb filters that manipulate raw packets before/after the rest of the kernel sees them, but this view is wrong, and doesn't explain, for example, how it does NAT. And the answer is it doesn't do NAT. The code is already preparing to do NAT, and that code merely consults the table to find out what kind of NAT it should do. The diagram makes it look like you can just move a NAT rule to a filter or mangle rule because the kernel just applies these tables in sequence anyway, but you can't because they are consulted by different blocks of code for different purposes.
- Koffiepoeder 1y agoCan you share the diagram? Would love to become iptables-enlightened.
- elevation 1y agoEventually I used more detailed diagrams, but this one was like a lightbulb going off: https://www.frozentux.net/iptables-tutorial/images/tables_traverse.jpg https://www.frozentux.net/iptables-tutorial/images/tables_tr... I couldn’t find one that annotated where sysctl configurable were shown. But this is a useful annotation, even if it’s an exercise for the reader.
- eptcyka 1y agoIt is time to be nftables enlightened instead.
- VTimofeenko 1y agoSimilar diagram, right in nftables wiki: https://wiki.nftables.org/wiki-nftables/index.php/Netfilter_hooks#Netfilter_hooks_into_Linux_networking_packet_flows https://wiki.nftables.org/wiki-nftables/index.php/Netfilter_...
- Arch-TK 1y agoIt's more of a netfilter (the thing behind iptables and nftables) diagram rather than just iptables. If you know how iptables maps to that diagram you are very likely to be able to quickly understand how nftables does too.
- eptcyka 1y agoSure, but we really shouldn’t be encouraging the use of iptables in 2025.
- mmh0000 1y agoThat's not realalistic for most of the Linux world. Soooo many systems are still using iptables even though we "should" be using nft everywhere. If you're going to be a Linux Sys/Net Admin today, you need an understanding of both systems.
- PunchyHamster 1y agoIt is also worth mentioning TRACE target that will dump to logs which exact rule the packet hit, it's invaluable big firewalls.
- waynesonfire 1y ago> I failed to use IP tables for years. Me too, then I discovered FreeBSD and pf tables. I _feel_ like an expert network engineer now. It took time and effort of course, but the learning process "clicked" for me all along the way and I was able to build on my understandings. Give it a try! https://docs.freebsd.org/en/books/handbook/firewalls/ https://docs.freebsd.org/en/books/handbook/firewalls/ There was a recent book published on the tool, The Book of PF, 4th Edition