NAME

       filter_backends - output drivers for the filtergen packet filter compiler

INTRODUCTION

       This  document  describes  the status and feature-set of the currently available filtergen
       backends.

IPTABLES, IP6TABLES

       Most development  is  done  first  against  the  iptables  driver.   It  supports  reject,
       masquerading,  transparent  proxying,  logging  (with  text)  and sub-groups, all of which
       should work fine (though the latter has only recently been fixed).

       The ip6tables driver is the IPv6 equivalent of the iptables driver.

IPTABLES-RESTORE, IP6TABLES-RESTORE

       The iptables-restore driver supports all of the features of the iptables driver. It  emits
       a ruleset that is loaded atomically into Netfilter using iptables-restore.

       The ip6tables-restore driver is the IPv6 equivalent of the iptables-restore driver.

IPCHAINS

       The  ipchains  driver  supports  all  of the above features, too.  Its state model is much
       weaker though, of course.  The forwarding  support  should  work  OK,  though  it  is  not
       possible to support "local"-only packets.

IPFILTER

       The ipfilter backend is incomplete.  It supports accept, drop, reject and logging, but not
       masq, transproxy or sub-groups.  It should be easy for someone with knowledge of  ipfilter
       to add support for the other features.  Options for OpenBSD "pf" features and syntax would
       be nice, too.  It has received no testing; I don't even know if the generated filters  are
       syntactically correct.

CISCO

       The  cisco driver is in roughly the same sort of state as the ipfilter one.  Additionally,
       because of the limitations of IOS ACLs, it supports only a limited set  of  features.   It
       cannot support reject or transparent proxying, and may not be able to support masquerading
       either.  An option for reflexive (stateful) ACLs would be very useful.

       I understand that Cisco PIX firewalls use a variant of this syntax --  it  would  be  very
       nice to support them too.

SEE ALSO

       filtergen(8), filter_syntax(5)

                                         January 7, 2004                       FILTER BACKENDS(7)