To the tables! Routing efficiently with iproute and Netfilter
summary
Shows concrete Linux networking techniques: how to use ip route entries to steer packets without NAT, and how to configure iptables DNAT/SNAT rules in PREROUTING/POSTROUTING plus a local chain to avoid hairpinning, with examples where masquerade fails. Includes debugging methods using tcpdump and Wireshark, explains common failure modes (wrong reply-to host, lost responses), and reviews modern alternatives—nftables/nft, bpfilter, and eBPF/XDP—describing their advantages and when they are effective.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:06Routing and Netfilter
- 10:59Basic routing with ip route
- 13:29NAT and iptables
- 28:06Advanced iptables rules
- 31:15Routing vs NAT
- 34:30Modern evolutions: nftables and BPF
- 39:10Modern best practices
- 42:25Masquerade: when to avoid
related talks
49mBGP and OSPF
35mEbpf with Rust: The Journey of a Package
31mBuilding a Hypervisor Firewall with nftables and Rust
42mLife, 42, the global routing table and answers to other questions
20mKubernetes Networking 101
42mAccelerating Envoy with the Linux Kernel
29mUsing the Internet as Your Load-Balancer
32mDemystifying eBPF - eBPF Firewall from scratch