BFU: iptables - diagram
feyd na seznam.cz
feyd na seznam.cz
Sobota Březen 8 12:19:16 CET 2003
On Sat, 08 Mar 2003 11:13:59 +0000
Roman Slechta <rxxa01 na tiscali.cz> wrote:
> Dekuji vsem,
>
> ale nenasel jsem to co jsem puvodne hledal. Bzl bz nekdo ochotny
> nakreslit jak paket cestuje pres vsechny chainy? Na webu jsem nasel dva
z archivu lartc:
To: lartc na mailman.ds9a.nl
From: Leonardo Balliache <leoball na opalsoft.net>
Subject: [LARTC] kernel packet traveling diagram
Sorry everyone, I'm late.. always!!
Here is a new version of kernel packet traveling diagram. Thanks a lot
to Julian Anastasov by his comments (notes at the end as I understood).
I insist it's nice to have this diagram ready and updated. Look that
when Jan Coppens needed to tell us where he does need to mark packets
he just said "At this point I should need another mangle table->" using
the diagram as reference.
We understand that internal kernel code is complex and interlaced and
not always is possible to identify clearly each part of it in a simple
diagram. But we keep on trying.
I've got some comments:
1) I didn't know there was ipchains code in kernel 2.4; I supposed
iptables new code replace totally old ipchains code. Any feedback
about it would be useful.
2) Below I enclosed a link to an article from Harald Welte "The journey
of a packet through the linux 2.4 network stack"; it could help to the
discussion and getting an improved diagram, if it's possible.
http://www.gnumonks.org/ftp/pub/doc/packet-journey-2.4.html
3) TODO: include LVS in the diagram. Julian give us this link to study the
issue and trying to complete the diagram.
http://www.linuxvirtualserver.org/Joseph.Mack/HOWTO/LVS-HOWTO-19.html#ss19.21
4) Of course, diagram is ready to be shoot it off. Any comment, criticism,
etc,. is welcome.
Best regards,
Leonardo Balliache
Network
-----------+-----------
|
+-------+------+
| mangle |
| PREROUTING | <- MARK REWRITE
+-------+------+
|
+-------+------+
| nat |
| PREROUTING | <- DEST REWRITE
+-------+------+
|
+-------+------+
| ipchains |
| FILTER |
+-------+------+
|
+-------+------+
| QOS |
| INGRESS | <- controlled by tc
+-------+------+
|
packet is for +-------+------+ packet is for
this address | INPUT | another address
+--------------+ ROUTING +---------------+
| | + PRDB | |
| +--------------+ |
+-------+------+ |
| filter | |
| INPUT | |
+-------+------+ |
| |
+-------+------+ |
| Local | |
| Process | |
+-------+------+ |
| |
+-------+------+ |
| OUTPUT | +-------+-------+
| ROUTING | | filter |
+-------+------+ | FORWARD |
| +-------+-------+
+-------+------+ |
| mangle | |
| OUTPUT | MARK REWRITE |
+-------+------+ |
| |
+-------+------+ |
| nat | |
| OUTPUT | DEST REWRITE |
+-------+------+ |
| |
+-------+------+ |
| filter | |
| OUTPUT | |
+-------+------+ |
| |
+----------------+ +--------------------+
| |
+--+-------+---+
| ipchains |
| FILTER |
+-------+------+
|
+-------+------+
| nat |
| POSTROUTING | SOURCE REWRITE
+-------+------+
|
+-------+------+
| QOS |
| EGRESS | <- controlled by tc
+-------+------+
|
-----------+-----------
Network
Notes:
1) The input routing determines local/forward.
2) ip rule (policy routing database PRDB) is input routing, more correctly,
part of the input routing.
3) The output routing is performed from "higher layer".
4) nexthop and output device are determined both from the input and the
output routing.
5) The forwarding process is called at input routing by functions from
specific place in the code. It executes after input routing and does not
perform nexthop/outdev selection. It's the process of receiving and
sending the same packet but in the context of all these hooks the code
that sends ICMP redirects (demanded from input routing), decs the IP TTL,
performs dumb NAT and calls the filter chain. This code is used only for
forwarded packets.
6) Sometimes the word "Forwarding" with "big F", is used for referencing both,
the routing and forwarding process.
feyd
Další informace o konferenci Linux