netfiltre

Netfiltre, a term often used interchangeably with Netfilter, is a framework built into the Linux kernel that provides packet filtering, network address translation (NAT), and other network-processing facilities. It attaches to several points in the network stack, allowing userspace programs to inspect, alter, or drop packets as they traverse the system.

Core components include nf_tables, nf_conntrack, and a set of userspace tools for configuring rules. nf_tables provides a modern, table-based language for matching packets and specifying actions; nf_conntrack implements stateful connection tracking so rules can depend on connection state. The traditional iptables, ip6tables, arptables, and ebtables interfaces operate against these kernel subsystems, with nftables offering a newer unified interface.

History and evolution: Netfilter originated in the Linux kernel as part of the Netfilter project, becoming a stable and widely used component from the 2.4 and 2.6 series. In the 2010s, nftables emerged as a replacement for the legacy iptables/nftables interfaces, providing a single API for IPv4 and IPv6 rule sets; today, nftables is the recommended interface, while iptables remains available via a compatibility layer.

Typical use cases include firewalling, NAT (DNAT/SNAT), port forwarding, and basic traffic shaping when combined with other kernel subsystems. Rules are evaluated in chains and tables according to the packet's direction and protocol, and actions such as accept, drop, or modify are applied.

Impact and scope: Netfilter is central to Linux-based security and routing deployments, from personal servers to enterprise gateways and embedded devices. It is open source, maintained within the Linux kernel, and supported by a large ecosystem of users and developers.