Linux Netfilter Deep Dive: Connection Tracking and Firewall Chain Analysis

Understanding Netfilter Architecture

Netfilter is the Linux kernel framework that provides packet filtering, NAT, and connection tracking. Understanding its architecture is essential for troubleshooting firewall rules and network connectivity issues.

Connection Tracking (conntrack)

Connection tracking maintains a table of all active network connections, enabling stateful packet inspection and NAT.

conntrack -C
cat /proc/sys/net/netfilter/nf_conntrack_count
cat /proc/sys/net/netfilter/nf_conntrack_max
conntrack -L | head -20

Netfilter Tables and Chains

# nftables (modern)
nft list tables
nft list ruleset

# iptables (legacy)
iptables -L -n -v
iptables -t nat -L -n -v
iptables -t mangle -L -n -v

Monitoring Dropped Packets

iptables -L -n -v | grep -E "DROP|REJECT"
journalctl -k | grep "DROPPED"
dmesg | grep "iptables"

Automated Analysis with dargslan-netfilter-check

pip install dargslan-netfilter-check
dargslan-netfilter-check
dargslan-netfilter-check --conntrack
dargslan-netfilter-check --dropped