FILTER_BACKENDS(7) - Linux man page online | Overview, conventions, and miscellany
Output drivers for the filtergen packet filter compiler.
January 7, 2004
FILTER BACKENDS(7) Miscellaneous Information Manual FILTER BACKENDS(7)
January 7, 2004 FILTER BACKENDS(7)
NAMEfilter_backends - output drivers for the filtergen packet filter compiler
INTRODUCTIONThis document describes the status and feature-set of the currently available filtergen backends. IPTABLES, IP6TABLES Most development is done first against the iptables driver. It supports reject, mas‐ querading, transparent proxying, logging (with text) and sub-groups, all of which should work fine (though the latter has only recently been fixed). The ip6tables driver is the IPv6 equivalent of the iptables driver. IPTABLES-RESTORE, IP6TABLES-RESTORE The iptables-restore driver supports all of the features of the iptables driver. It emits a ruleset that is loaded atomically into Netfilter using iptables-restore. The ip6tables-restore driver is the IPv6 equivalent of the iptables-restore driver.
IPCHAINSThe ipchains driver supports all of the above features, too. Its state model is much weaker though, of course. The forwarding support should work OK, though it is not possi‐ ble to support "local"-only packets.
IPFILTERThe ipfilter backend is incomplete. It supports accept, drop, reject and logging, but not masq, transproxy or sub-groups. It should be easy for someone with knowledge of ipfilter to add support for the other features. Options for OpenBSD "pf" features and syntax would be nice, too. It has received no testing; I don't even know if the generated filters are syntactically correct.
CISCOThe cisco driver is in roughly the same sort of state as the ipfilter one. Additionally, because of the limitations of IOS ACLs, it supports only a limited set of features. It cannot support reject or transparent proxying, and may not be able to support masquerading either. An option for reflexive (stateful) ACLs would be very useful. I understand that Cisco PIX firewalls use a variant of this syntax -- it would be very nice to support them too.
SEE ALSOfiltergen(8), filter_syntax(5)
|This manual||Reference||Other manuals|
|filter_backends(7)||referred by||filter_syntax(5) | filtergen(8)|
|refer to||filter_syntax(5) | filtergen(8)|