FILTER_BACKENDS(7)

💖 FILTER_BACKENDS 💖

okay bestie, welcome to filter_backends(7) — the tea on the output drivers for the filtergen packet filter compiler. pour yourself a lil drink, we're doing a full vibe check on every backend. 🫶

---

🌸 NAME 🌸

filter_backends — the output drivers for the filtergen packet filter compiler, no cap

---

✨ INTRODUCTION ✨

so this whole doc is literally just the status report and the feature-set of every filtergen backend that's out here right now. who's slaying, who's still getting ready, we're covering it all. 💅

---

🔥 IPTABLES, IP6TABLES 🔥

okay so the iptables driver is the main character — most development happens against it first, periodt. it supports:

• reject
• masquerading
• transparent proxying
• logging (with text 👑)
• sub-groups

...and all of those should work fine, fr fr. tho real talk, the sub-groups one has only recently been fixed, so don't come for it.

the ip6tables driver? it's the IPv6 equivalent of the iptables driver. same energy, six-er addresses. 🌈

---

💜 IPTABLES-RESTORE, IP6TABLES-RESTORE 💜

the iptables-restore driver supports all of the features of the iptables driver. all of them. it emits a ruleset that gets loaded atomically into Netfilter using iptables-restore — so it's giving instant, no-halfway nonsense. ✨

and the ip6tables-restore driver is the IPv6 equivalent of the iptables-restore driver. obviously. 💅

---

🦋 IPCHAINS 🦋

the ipchains driver supports all of the above features too. icon behaviour honestly.

but its state model is much weaker though, of course. can't have everything, bestie. the forwarding support should work OK, though — it is not possible to support "local"-only packets. noted. 📝

---

🧚 IPFILTER 🧚

okay so the ipfilter backend is incomplete. it's giving work-in-progress, not finished.

what it supports:

• accept
• drop
• reject
• logging

what it does not support:

• masq
• transproxy
• sub-groups

ngl it should be easy for someone with knowledge of ipfilter to add support for the other features — so if that's you, go off. 👑 options for OpenBSD "pf" features and syntax would be nice, too.

⚠️ real talk: it has received no testing. the author doesn't even know if the generated filters are syntactically correct. 💀 proceed accordingly.

---

🌟 CISCO 🌟

the cisco driver is in roughly the same sort of state as the ipfilter one. and on top of that, because of the limitations of IOS ACLs, it supports only a limited set of features.

• it cannot support reject
• it cannot support transparent proxying
• and it may not be able to support masquerading either 😭

an option for reflexive (stateful) ACLs would be very useful, just saying. 🙈

also — the author understands that Cisco PIX firewalls use a variant of this syntax, and it would be very nice to support them too. someone please make it happen. 🎀

---

🎀 SEE ALSO 🎀

• filtergen(8)
• filter_syntax(5)

---

and that's the whole thing, bestie! ✨ this lil masterpiece is from the Miscellaneous Information Manual, dated January 7, 2004, and it goes by FILTER BACKENDS(7). go forth and filter, you absolute legend. 💖🦋💅