2 - Raspberry PI Community Projects

• INPUT: concerns packets whose destination is the firewall itself;
• OUTPUT: concerns packets emitted by the firewall;
• FORWARD: concerns packets transiting through the firewall (which is neither their
source nor their destination).
The nat table also has three standard chains:
• PREROUTING: to modify packets as soon as they arrive;
• POSTROUTING: to modify packets when they are ready to go on their way;
• OUTPUT: to modify packets generated by the firewall itself.
Figure 14.1
How netfilter chains are called
Each chain is a list of rules; each rule is a set of conditions and an action to execute when the
conditions are met. When processing a packet, the firewall scans the appropriate chain, one
rule after another; when the conditions for one rule are met, it “jumps” (hence the -j option in
the commands) to the specified action to continue processing. The most common behaviors are
standardized, and dedicated actions exist for them. Taking one of these standard actions interrupts
the processing of the chain, since the packet's fate is already sealed (barring an exception
mentioned below):
BACK TO BASICS
ICMP
ICMP (Internet Control Message Protocol) is the protocol used to transmit complementary
information on communications. It allows testing network connectivity
with the ping command (which sends an ICMP echo request message,
which the recipient is meant to answer with an ICMP echo reply message).
It signals a firewall rejecting a packet, indicates an overflow in a receive
buffer, proposes a beer route for the next packets in the connection, and so
on. This protocol is defined by several RFC documents; the initial RFC777 and
RFC792 were soon completed and extended.
Chapter 14 — Security
377