IPTables and Netfilter Flashcards
What are the five netfilter hooks?
NF_IP_ROUTING, NF_IP_LOCAL_IN, NF_IP_FORWARD, NF_IP_LOCAL_OUT, NF_IP_POST_ROUTING
what is PRE_ROUTING netfilter hook?
hook is triggered by any incoming traffic entering the network stack. This hook is processed before any routing decisions have been made.
what is LOCAL_IN netfilter hook
hook is triggered after an incoming packet has been routed if the destination is the local system
what is _FORWARD
hook is triggered after an incoming packet has been routed if the packet is to be forwarded to another host
what is LOCAL_OUT netfilter hook
triggered by any locally created outbound traffic as soon as it hits the network stack
what is POST_ROUTING netfilter hook
this hook is triggered by any outgoing for forwarded traffic after routing as taken place, before being sent out on wire
what determines the order of hook calls if multiple kooks are registered?
hooks are registered with a priority number.
What are the tables of IP tables
NAT, FILTER, MANGLE, RAW, SECURITY
What are the chains of each table
PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING
what is the purpose of the filter table?
decide to allow packet to continue to destination or not
what is the purpose of the NAT table
used to implement network address translation. The source or destination is changed.
what is the purpose of the Mangle table
Used to alter the ip headers
what is the purpose of the raw table
to mark packets to avoid connection tracking
what are the two types of NAT
DNAT (destination) and SNAT (source)
Does NAT processing come before Filter?
DNAT does, but SNAT does not
T/F nat rules are created on the first packet and will be applied to the stream?
True
T/F iptables is stateful
True
T/F NAT rules applied to a stream will be applied to responses
Yes, response have the reverse NAT rules applied
What chains are applied to incoming destined for host?
PREROUTING -> INPUT
What chains are applied to incoming, meant for another host?
PREROUTING -> FORWARD -> POSTROUTING
Locally Generated Packets
OUTPUT - > POSTROUTING
What are targets and terminating vs nonterminating
when a packet meets a matching criteria. Terminating stops traversing the chain
What is the matching portion of a rule
Rules can be created to match protocol type, destination and source address and port.
Connections are tracked by netfilter’s connection tracking, what are the states?
new, established, related, invalid, untracked,
