Chapter 6. netfilter and iptables Overview

The first thing to get out of the way is that netfilter and iptables are not the same thing. They are largely written by the same group of developers, but they are very different parts of a whole. netfilter comprises the kernel level code that Linux can use to conduct packet filtering, state management, NAT, packet mangling, QOS, and other neat tricks. iptables is the userland tool that can manipulate these kernel hooks to do these things for you. It's important to point this out because there are other userland tools that use netfilter as well and that also can accomplish some pretty neat tricks.