Rusty put 5 hooks:
In addition to IPV4, people have contributed support for IPv6, DECNET, Appletalk
in IPX (and Rusty made humoristic comments on the important future of packet
filtering on DECNET and Appletalk. Did I mention that Rusty is a really fun
Netfilter has enough hooks to cleanly extend functionality for filtering, NAT, and random hacks and the plan is that we won't need yet another system with yet another interface in 2.5/2.6, although Rusty likes "Rusty chains" as a name for the next version
IP tables allows for several chains, like ipchains, but also for several tables
(filter, NAT and Mangle). It now lets you target packets in 5 places (listed
above), where (I quote) "god intended them to be"
NAT can be done in 3 places (pre_routing (dest rewrite), local_out (dest rewrite), and post_routing (source rewrite)). The main idea is that here, you can write your filtering rules independantly from the NAT rewriting.
The Mangle table is used for special effects and hacks.
User visible changes:
Connection tracking is a new thing too. It's useful for connectionless protocols
like UDP and ping. The default timeout for an open TCP connection was 10mn in
2.2, which closed open but idle connections like ssh way too quickly. The
default is now changed to 5 days.
Under stress, the connection tracking code will drop unreplied connections early. What's cool is that the ftp connection tracking module lets you temporarly open the right ports long enough for an active ftp connection to be accepted.
As far as NAT is concerned, The code now offers SNAT (source NAT = masquerading)
and DNAT (port forwarding and load balancing).
For NAT, you get to choose between dumb NAT, which is really fast and simple, and full NAT which has all the bells and whistles.
As always, attending one of Rusty's talks was both interesting and entertaining.
I should also mention that rusty is a very professional hacker. He takes great
care of not breaking anything, and does care about backward compatibility.
You can look at his slides here
|Picture library||Back to Main Page||Next page|
2000/08/21 (20:25): Version 1.0