netfilter&firewalld防火墙学习路线

netfilter&firewalld iptables 学习路线

netfilter

Netfilter学习笔记

Linux协议栈-netfilter(1)-框架

Linux内核中Netfilter架构介绍

Linux Netfilter开发小结

深入Linux网络核心堆栈（对于netfilter的用法和讲解）

Linux netfilter 学习笔记 之十五 netfilter模块添加一个match

Linux的Netfilter框架深度思考-对比Cisco的ACL-

Netfilter的使用和实现

Linux内核中Netfilter架构介绍

Netfilter的原理和实现浅析

firewalled

iptables

iptables详解

iptables命令格式

iptables过滤条件

包过滤防火墙工作原理

技术原理

数据包的内核路径图

Netfilter是Linux 2.4.x引入的一个子系统，它作为一个通用的、抽象的框架，提供一整套的hook函数的管理机制，使得诸如数据包过滤、网络地址转换(NAT)和基于协议类型的连接跟踪成为了可能。
netfilter的架构就是在整个网络流程的若干位置放置了一些检测点（HOOK），而在每个检测点上登记了一些处理函数进行处理。

netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack.

iptables is a generic table structure for the definition of rulesets. Each rule within an IP table consists of a number of classifiers (iptables matches) and one connected action (iptables target).

netfilter, ip_tables, connection tracking (ip_conntrack, nf_conntrack) and the NAT subsystem together build the major parts of the framework.

Main Features

stateless packet filtering (IPv4 and IPv6)
stateful packet filtering (IPv4 and IPv6)
all kinds of network address and port translation, e.g. NAT/NAPT (IPv4 and IPv6)
flexible and extensible infrastructure
multiple layers of API’s for 3rd party extensions
What can I do with netfilter/iptables?

build internet firewalls based on stateless and stateful packet filtering
deploy highly available stateless and stateful firewall clusters
use NAT and masquerading for sharing internet access if you don’t have enough public IP addresses
use NAT to implement transparent proxies
aid the tc and iproute2 systems used to build sophisticated QoS and policy routers
do further packet manipulation (mangling) like altering the TOS/DSCP/ECN bits of the IP header

iptables传输数据包的过程

!

!

!

!

生产案例

引用

http://www.netfilter.org/

https://baike.baidu.com/item/netfilter/8916221?fr=aladdin

http://www.linuxso.com/linuxpeixun/10332.html