netfiler/iptables

标签：spec   track   gis   ddr   UI   generic   module   back   connected   

一. 什么是netfilter

netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack.

iptables is a generic table structure for the definition of rulesets. Each rule within an IP table consists of a number of classifiers (iptables matches) and one connected action (iptables target).

netfilter, ip_tables, connection tracking (ip_conntrack, nf_conntrack) and the NAT subsystem together build the major parts of  the packet filtering framework. Software inside this framework enables packet filtering, network address [and port] translation (NA[P]T) and other packet mangling. 

参考：

1. http://www.netfilter.org/

netfiler/iptables

标签：spec   track   gis   ddr   UI   generic   module   back   connected   

原文地址：http://www.cnblogs.com/embedded-linux/p/7895256.html