Netfilter and BPF/XDP

Coverage: Netfilter hooks → iptables/nftables → conntrack → NAT/masquerade → XDP → BPF/cBPF/eBPF → TC BPF Kernel versions: 2.6 ~ 6.x

Overview

Netfilter is Linux's packet filtering/modification engine, providing the underlying foundation for iptables (legacy) and nftables (modern). XDP/eBPF represents a newer paradigm—executing user-provided programs at the earliest packet reception point in the kernel (network card driver layer) to achieve high-performance packet processing.

Netfilter Hooks

// include/uapi/linux/netfilter.h
// 5 hook points (IPv4 example):

enum nf_inet_hooks {
    NF_INET_PRE_ROUTING,   // Packet arrives, before routing
    NF_INET_LOCAL_IN,      // Packets destined for local host, after routing
    NF_INET_FORWARD,       // Forwarded packets
    NF_INET_LOCAL_OUT,     // Packets originating from local host, before routing
    NF_INET_POST_ROUTING,  // All outgoing packets, after routing
};

// Each hook point: registered hook functions are called in priority order
// Return values:
//   NF_ACCEPT:  Packet accepted (normal)
//   NF_DROP:    Packet dropped (no notification to sender)
//   NF_STOLEN:  Packet taken over by the hook
//   NF_QUEUE:   Packet queued to userspace (nfnetlink_queue)

iptables (Legacy, based on xtables)

// net/ipv4/netfilter/ip_tables.c
// filter table (default):
//   INPUT:   Packets destined for local host
//   OUTPUT:  Packets originating from local host
//   FORWARD: Forwarded packets

// nat table:
//   PREROUTING  (DNAT)
//   INPUT       (DNAT for packets destined for local host)
//   OUTPUT      (DNAT for packets originating from local host)
//   POSTROUTING (SNAT/MASQUERADE)

// mangle table: Modify TOS/TTL/MARK
// raw table:    NOTRACK (skip conntrack)

nftables (Modern, replacing iptables)

// net/netfilter/nf_tables_api.c
// nft executes rules using a virtual machine (not linear matching like iptables)
// More flexible: native support for sets, maps, concatenation
// Faster: single traversal of rules replaces multiple traversals of multiple tables

// nft list ruleset
// table inet filter {
//     chain input { type filter hook input priority 0; policy drop;
//         ct state established,related accept
//         iif lo accept
//         tcp dport 22 accept
//     }
// }

Connection Tracking (conntrack)

// net/netfilter/nf_conntrack_core.c
// conntrack tracks the state of each connection (flow)
//   → NAT depends on it (to know which flow a return packet belongs to)
//   → iptables state match depends on it

// conntrack table:
//   One nf_conn per connection → hash table
//   Maximum entries: /proc/sys/net/netfilter/nf_conntrack_max
//   Timeouts: Each protocol has independent timeouts (TCP: 432000s ≈ 5 days for ESTABLISHED)

// Careful! On NAT gateways, the conntrack table may fill up
//   → Packet loss → New connection failures
//   → Increase nf_conntrack_max or reduce timeouts

NAT / MASQUERADE

SNAT (Source NAT):
  Modify source IP:port → Outbound IP:new port
  conntrack records: orig_src:port → reply_dst:port → Reply packets converted back

MASQUERADE:
  Dynamic SNAT — automatically uses the current IP of the outbound interface
  Suitable for: DHCP clients (outbound IP may change)

DNAT (Destination NAT):
  Modify destination IP:port → Internal server
  → Port forwarding

XDP: eXpress Data Path

// net/core/filter.c + drivers/net/*_xdp.c
// XDP: Runs BPF programs within the network card driver's NAPI poll, before sk_buff allocation
//   Extremely early processing point → Extremely high PPS (Mpps level)
//   Can: DROP (fastest), TX (forward), PASS (to protocol stack), REDIRECT (to another NIC)

// BPF program return values:
enum xdp_action {
    XDP_DROP,       // Drop (e.g., DDoS filtering)
    XDP_PASS,       // Pass to protocol stack (normal flow)
    XDP_TX,         // Transmit from this NIC (hairpin)
    XDP_REDIRECT,   // Redirect to another NIC or CPU
};

// Loading: via bpftool or ip link set dev eth0 xdp obj prog.o sec xdp

eBPF Program Types

References

• Source Code: net/netfilter/, net/core/filter.c, kernel/bpf/
• Kernel Documentation: Documentation/networking/filter.rst, Documentation/bpf/
• LWN: "XDP and the packet processing revolution"

Keywords: netfilter, iptables, nftables, conntrack, NAT, XDP, BPF, eBPF, TC BPF