Understand the iptables step by step

COSCUP2018
x
openSUSE.Asia GNOME.Asia
I am Hung-Wei Chiu
Co-organizer of SDNDS-TW
Co-organizer of CNTUUG
I love
Linux Network/Kubernetes/SDN
You can find me at:
blog.hwchiu.com

COSCUP2018
x
How Many People Known Iptables?

COSCUP2018
x
Network
Interface Card
PREROUUTING
Network
Interface Card
POSTROUUTING
INPUT OUTPUT
INPUT OUTPUT
FORWARDRouting Routing
LOCAL PROCESS
DNAT

COSCUP2018
x
We Don’t Focus On Those Table/Chain
Today

COSCUP2018
x
User Space
Kernel Space
iptables ebtables application
netlink/system call
Kernel
netfilter system
Network
Interface Card
Network
Interface Card

COSCUP2018
x
iptables, a command-line tool

COSCUP2018
x
iptables
Home:
○ https://www.netfilter.org/downloads.ht
ml
Git
○ git://git.netfilter.org/iptables.git

COSCUP2018
x
We Focus On What Will Happen For
Each Command

COSCUP2018
x
Do You Have Meet The Following
Message?

COSCUP2018
x
Another app is currently holding
the xtables lock. Perhaps you
want to use the -w option?

COSCUP2018
x
Whathappen
iptables command needs a
communication between user and
kernel space.
It need a lock to make sure the
consistence
iptables will exit if it can’t acquire the
lock by default.
Use the –w option to wait the lock.

COSCUP2018
x
Let Read The Source Code

COSCUP2018
x

COSCUP2018
x
v
v

COSCUP2018
x
So, We Know The Iptables Use The File
Lock

COSCUP2018
x
Do You Meet The Duplicated Rules ?

COSCUP2018
x
How Could We Solve This?

COSCUP2018
x
solution
Custom chain
○ Use the ‘-F’ to flush all rules.
Check before inserting rule
○ Use the ‘-C’ to check.
Modify the iptables to avoid
duplicated rules.

COSCUP2018
x
Now, Let We Learn How To Flush The
Rules.

COSCUP2018
x
c
c
c

COSCUP2018
x
First, we need to know how iptables
works with kernel?

COSCUP2018
x
libiptc

COSCUP2018
x
libiptc
Library which manipulates firewall
rules
Use the system call to interact with
kernel
○ GetSocketOpt
○ SetSocketOpt
Maintain a cache for each iptables
command.

COSCUP2018
x
workflows
Initial the libiptc to fetch all current
rules.
Store those rules into a local cache
Operates rules in that cache
Commit the change to the kernel.

COSCUP2018
x
workflows
rules.
In the iptables, we use a handle
(xtc_handle) to represent the cache.

COSCUP2018
x
initlibiptc
rules.

COSCUP2018
x
c
c

COSCUP2018
x
Now, we have the cache of the current
rules.

COSCUP2018
x
Let We Flush Rules

COSCUP2018
x
c

COSCUP2018
x
Now, We Have Remove Rules From
Cache

COSCUP2018
x
We Commit The Change After Any
Commands

COSCUP2018
x
Now, We Have Flush The Rules.

COSCUP2018
x
Now, Let’s See What’s The Extension

COSCUP2018
x
Custom Match Field
–m tcp –dport 1234

COSCUP2018
x
Custom Target Field
–j AUDIT –type accept

COSCUP2018
x
User Space
Kernel Space
iptables
extensions
netlink/system call
Kernel
netfilter system
Network
Interface Card
Network
Interface Card
extensions
extensions
extensions
Kernel module
Kernel module
Kernel module
Kernel module

COSCUP2018
x
Architecture
For each extension, you need to
prepare two things.
User-space library to parse the
command.
Kernel-space module to implement
that function.

COSCUP2018
x
For User-Space, iptables command
should know how to parse arguments.

COSCUP2018
x
Howtoread
Function
○ DNAT (upper) -> target
○ tcp (lower) -> match
File naming
Old style
○ libipt_ -> ipv4
○ libip6t -> ipv6
New Style
○ libxt -> ipv4/ipv6

COSCUP2018
x
Now, We Take The Custom Match TCP
as Example

COSCUP2018
x
Architecture
iptables/extensions/libxt_tcp.c

COSCUP2018
x
Architecture
iptables/extensions/libxt_tcp.c
c

COSCUP2018
x
For Kernel-Space, There’re Some
Kernel Modules In The System.

COSCUP2018
x
v

COSCUP2018
x
Demo Time

COSCUP2018
x
summary
The iptables system includes the
user-space tool and kernel-space
system.
We focus on how user-space tools
works today.

COSCUP2018
x
iptables
iptables need a file lock to protect the
rules.
iptables use the library (libiptc) to
control the rules via system call.
You can extend the iptables by
implement the extension
match/target function.

COSCUP2018
x
Extenstion
For each iptables extension module,
you should both user-space and
kernel-space.
Please make sure the kernel version
consistent
Use—Space
○ Implement the arguments and store the
data into pre-defined structure.
Kernel-Space
○ Implement the match function

COSCUP2018
x
Thanks!

Understand the iptables step by step

More Related Content

What's hot

Similar to Understand the iptables step by step

More from HungWei Chiu

Recently uploaded

Understand the iptables step by step