Packet Filtering - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Chapter 43. Securing Your Network
Warning
The default firewall mechanism in the 2.4 and later kernels is iptables, but iptables
cannot be used if ipchains is already running. If ipchains is present at boot time, the
kernel issues an error and fails to start iptables.
The functionality of ipchains is not affected by these errors.

43.9.1. Packet Filtering

The Linux kernel uses the Netfilter facility to filter packets, allowing some of them to be received by or
pass through the system while stopping others. This facility is built in to the Linux kernel, and has three
built-in tables or rules lists, as follows:
• filter — The default table for handling network packets.
• nat — Used to alter packets that create a new connection and used for Network Address
Translation (NAT).
• mangle — Used for specific types of packet alteration.
Each table has a group of built-in chains, which correspond to the actions performed on the packet by
netfilter.
The built-in chains for the filter table are as follows:
• INPUT — Applies to network packets that are targeted for the host.
• OUTPUT — Applies to locally-generated network packets.
• FORWARD — Applies to network packets routed through the host.
The built-in chains for the nat table are as follows:
• PREROUTING — Alters network packets when they arrive.
• OUTPUT — Alters locally-generated network packets before they are sent out.
• POSTROUTING — Alters network packets before they are sent out.
The built-in chains for the mangle table are as follows:
• INPUT — Alters network packets targeted for the host.
• OUTPUT — Alters locally-generated network packets before they are sent out.
• FORWARD — Alters network packets routed through the host.
• PREROUTING — Alters incoming network packets before they are routed.
• POSTROUTING — Alters network packets before they are sent out.
Every network packet received by or sent from a Linux system is subject to at least one table.
However, a packet may be subjected to multiple rules within each table before emerging at the end
of the chain. The structure and purpose of these rules may vary, but they usually seek to identify a
710