Basic principles of iptables

Netfilter yes Linux A complete packet processing framework provided by the kernel , Through a set of hooks （hook） Management mechanism , Packet filtering can be realized 、 Network address translation and connection tracking based on protocol type ,Iptables Is based on Netfilter Packet filtering system , Detect and process the data message through the rules and processing actions set by yourself .

Iptables It is divided into two parts: kernel module and user mode , User space Iptables be located /sbin/ Under the table of contents , It is a command line tool for setting rules , Make corresponding rules through the command line , Specify the kernel module to perform the corresponding data access control . chain 、 Tables and rules are Iptables Several very important concepts in kernel processing .

• chain

Chains can also be called hooks , Refer to Iptables Time to filter .Iptables The current is PREROUTING、INPUT、FORWARD、OUTPUT and POSTROUTE 5 Seed chain , among PREROUTING Used to process packets before routing ,POSTROUTE Used to process packets after routing ,INPUT Used to process data packets sent to this machine ,OUTPUT Be responsible for processing data packets sent by this machine ,FORWARD Be responsible for processing the forwarded packets .

For different data streams , There are the following 3 A typical chain processing opportunity .

1） Packets sent to this machine ： When data packets are transmitted from the physical layer and the data link layer , If the packet is accessed Linux The host itself , Past the PREROUTING and INPUT Hook function , Reach the transport layer and application layer .

2） Forwarding packets ： Data packets are transmitted from the physical layer and the data link layer , If a packet needs to be forwarded , Past the PREROUTING、FORWARD and POSTROUTE 3 A hook function .

3） Send packet ： When a packet from Linux The host itself sends packets out , To pass OUTPUT and POSTROUTE Two hook functions .

• surface

Table is the module responsible for completing a certain filtering function ,Iptables The current is Filter surface 、NAT surface 、mangle Table and raw surface 4 individual , They correspond in the kernel 4 Different modules , The corresponding functions and hook functions of these modules are as follows .

1）Filter surface ：Filter Table is Iptables The default filtering function , Determine whether to release the data package , contain INPUT、FORWAD and OUTPUT 3 A hook function .

2）NAT surface ：NAT Table is responsible for modifying the source of the packet IPPORT And purpose IPPORT, contain PREROUTING、OUTPUT and POSTROUTE These hook functions .

3）mangle surface ：mangle Table is used to track connections , contain PREROUTING、INPUT、FORWARD、OUTPUT and POSTROUTE 5 A hook function .

4）raw surface ：raw Table for closing NAT The connection tracking function enabled on the table , contain PREROUTING、OUTPUT 2 A hook function .

Comprehensive, ,Iptables、 surface 、 The relationship between chains and rules is contained layer by layer ,Iptables Can contain multiple tables , Each table contains multiple chains , Each chain contains multiple rules for filtering .

• Iptables stay Istio The use of

Iptables Responsible for Envoy The inlet and outlet flows are intercepted . For inlet traffic interception , Assume that all traffic needs to be directed to Envoy agent ,8090 yes Envoy Listening port of ,Iptables The following rules ：

iptables -t nat -A PREROUTING -p tcp -j REDIRECT -to-port 8090

For outlet flow interception , It's a similar idea ,Iptables The following rules ：

iptables -t nat -A OUTPUT -p tcp -j REDIRECT -to-port 8090

adopt Iptables After blocking and forwarding , The target port has been rewritten , Can pass SO_ORIGINAL_DST TCP Socket gets the original ipport.