Re: netfilter vs iptables naming confusion

[Haris Koutsouris <harisk@epmhs.gr>]

Thank you very much. This clears the picture A LOT.

Regards

Haris

Henrik Nordstrom wrote:

>On Mon, 8 Dec 2003, Haris Koutsouris wrote:
>
>  
>
>><my understanding>
>>Netfilter is a set of hooks in the networking code of the linux kernel
>>  that allows another piece of code (kernel module) to register for 
>>access  to the packets that pass through these points.
>>    
>>
>
>Yes.
>
>  
>
>>Several iptables kernel modules (e.g ip_tables,
>>iptable_mangle,ipt_conntrack, ipt_LOG)  implement the firewalling
>>functionality and in addition the user space utility iptables is used as
>>a user interface to the iptables functionality.
>>    
>>
>
>Many also consider the connection tracking as part of the netfilter
>framework, and maybe even the NAT core in some respect, but it is a thin
>boundary especially considering that it is mainly iptables which use 
>these.
>
>But it is certainly correct to say that netfilter is the hook
>infrastrucure allowing the firewall access to the packet flow, and
>iptables is the firewalling code of iptables.
>
>  
>
>>A final question are the kernel modules named iptables modules or 
>>netfilter modules?????
>>    
>>
>
>There are both. The design is layered with modules at both layers.
>
>modules which registers netfilter hooks are netfilter modules. This
>includes iptables itself and the connection tracking, but there is also
>several other netfilter modules such as Linux Virtual Server or the HiPac
>firewall.
>
>modules which registers iptables targets/matches for use in the iptables
>firewall are iptables modules.
>
>Regards
>Henrik
>
>
>
>
>  
>