netfilter
also: netfilter framework
Netfilter is a Linux kernel subsystem that provides packet filtering, network address translation (NAT), and connection tracking capabilities. It allows administrators to control, modify, and filter network traffic.
Netfilter operates at the kernel level and intercepts network packets at various points in the networking stack. It provides hooks that allow packet inspection and manipulation before they reach applications or leave the system.
The primary user-facing tool for configuring netfilter is iptables (or the newer nftables), which lets you define rules for filtering incoming and outgoing traffic. Common use cases include building firewalls, implementing NAT for IP masquerading, and connection tracking.
Example: You can use netfilter rules to block all incoming SSH connections except from a trusted IP address, or to forward traffic from one port to another internal service.
Modern systems increasingly use nftables as the successor to iptables, though netfilter itself remains the underlying kernel infrastructure in both cases.