IPtables and Netfilter Hook Points

Trace the lifecycle of a packet as it traverses the host and container network boundary.

In this lesson, you will learn how a network packet traverses the Linux kernel’s Netfilter architecture when crossing the boundary between the host namespace and a container namespace.

The Netfilter Hook Architecture

When a packet enters the host, it is handled by the Netfilter framework, which provides five specific "hook points" where kernel modules (like iptables) can inspect, modify, or drop the traffic.

For a packet destined for a container attached to a veth pair and a Linux bridge, the lifecycle follows this path:

PREROUTING: The packet hits the host's physical interface. Here, iptables rules in the PREROUTING chain can perform DNAT (Destination NAT) to redirect external traffic to a container’s internal IP.
FORWARD: Since the packet is destined for an IP address inside a container, the host recognizes it is not for the local process. The packet passes through the FORWARD chain, where iptables checks the FORWARD policy to see if the bridge is allowed to route the packet to the container's veth interface.
POSTROUTING: After the packet traverses the bridge and is sent out the container-side veth pair, it may pass through the POSTROUTING chain. This is commonly used for SNAT (Masquerading), allowing the container to hide behind the host's IP address when communicating with the outside world.

Navigating the Namespace Boundary

The veth pair acts as the physical bridge between these namespaces. When you run iptables -t nat -A POSTROUTING -s 172.17.0.0/16 -j MASQUERADE, you are specifically hooking into the POSTROUTING point to manipulate packets as they leave the container's namespace boundary via the veth device.

# Example: Trace a packet flowing through the forward path
iptables -I FORWARD 1 -i eth0 -o veth-pair-name -j ACCEPT

Because container networking relies on bridge interfaces, the packet effectively "bounces" off the bridge. The Netfilter hooks act as the traffic controllers at this intersection, enforcing security policies defined by your container orchestrator before the packet is injected into the isolated network namespace of the container.

Key Takeaway: Netfilter hook points act as a programmable firewall pipeline, filtering and modifying packets as they transition from the host interface through the bridge and into the container’s virtual network namespace.