iptables and Netfilter

In short: Netfilter is the packet-filtering framework in the Linux kernel, iptables the classic tool for writing rules for it.

In more detail: Every packet passes hooks in the kernel. Rules in tables and chains decide whether it is accepted, dropped or rewritten. The successor is called nftables.

In Depth

• Tables: filter (allow/deny), nat (rewrite addresses), mangle (alter packets).
• Chains: INPUT (to this machine), OUTPUT (from it), FORWARD (passed through), plus PREROUTING and POSTROUTING.
• Rule: Condition plus target, such as -p tcp --dport 22 -j ACCEPT. The first matching rule wins, otherwise the chain’s default policy applies.
• Connection tracking: -m conntrack --ctstate ESTABLISHED,RELATED allows replies to your own connections.
• Use: Home routers, server firewalls, Docker (creates its own rules), port forwarding.
• Today: New systems use nftables or front ends such as ufw and firewalld. See NAT.

See also: fail2ban