Linux Networking

Linux exposes network state through namespace-aware interfaces. Since Linux 2.6.25, /proc/net is a compatibility symlink to /proc/self/net, so it describes the network namespace of the reading process. Modern tools normally use Netlink instead of parsing procfs.

Routes and Netlink #

The IPv4 Forwarding Information Base (FIB) determines where packets are sent. /proc/net/route is a historical view of it; ip route queries and changes the kernel through Netlink. Netlink is a family of message-oriented sockets that lets userspace configure and inspect kernel subsystems without adding a new syscall. Routing, links, addresses, neighbours, traffic control, and Netfilter all use it.

Netfilter and iptables #

Netfilter supplies packet-processing hooks in the networking stack. iptables is the traditional userspace rule manager for IPv4 (with ip6tables for IPv6); current systems commonly use nftables, whose compatibility layer can still accept iptables syntax.

The important iptables tables are:

• filter is the default filtering table, with INPUT, FORWARD, and OUTPUT chains.
• nat performs address or port translation for the first packet of a connection and has PREROUTING, INPUT, OUTPUT, and POSTROUTING chains.
• mangle changes specialized packet fields at several hooks.
• raw runs before connection tracking and can exempt traffic with NOTRACK.
• security applies mandatory-access-control labels after the filter table, for SELinux and related Linux Security Module policies.

Rules are evaluated in chain order. INPUT applies to packets addressed to local sockets, FORWARD to routed traffic, and OUTPUT to locally generated packets. Connection tracking lets later packets follow the decision made for their flow.