FOSS community-driven project that provides firewalling tools for Linux is home to the software of the packet filtering framework inside the Linux 2.4.x and later kernel series. Software commonly associated with is iptables.

Software inside this framework enables packet filtering, network address [and port] translation (NA[P]T) and other packet mangling. It is the re-designed and heavily improved successor of the previous Linux 2.2.x ipchains and Linux 2.0.x ipfwadm systems.

netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack.

iptables is a generic table structure for the definition of rulesets. Each rule within an IP table consists of a number of classifiers (iptables matches) and one connected action (iptables target).

netfilter, ip_tables, connection tracking (ip_conntrack, nf_conntrack) and the NAT subsystem together build the major parts of the framework.

lightbulb_outline View ideas list


  • linux
  • kernel
  • c


mail_outline Contact email

Netfilter project 2017 Projects

  • pablombg
    Development of nft-sync tool
    I would like to work in the, currently halted, development of nft-sync tool.
  • Shyam Saini
    Missing features in nftables.
    I'm interested in proposed Task 1 : Implement missing features in nftables.