iptables c++ control

Question

I need to control inbound and outbound traffic to/from a linux box from within a C++ program. I could call iptables from within my program, but I'd much rather cut out the middle man and access the kernel API functions myself.

I believe I need to use libnfnetlink, however, I have not been able to find any API documentation or example programs.

The rules I need to construct are fairly simple - things like dropping packets with a destination port equal to X etc. I do NOT intend to write a full firewall application.

can anyone suggest a better approach, or provide a link to some documentation or example apps? I'd rather avoid reading the iptables code, but i guess I may have to, if I can't find any better resources.

Answer 1

Why not just get the source to iptables and do it like they do it? Since it is open source....

Answer 2

Hi,

An year back I was having the same requirement and probed around. But after contacting some open source kernel guys this is what I came to know -

The kernel APIs of iptables are not externalisec, means to say, they are not documented APIs. In the sense, the APIs can change any moment. They should be used only by the iptables tool. they should not be used by the application developers.

-satish

Answer 3

You should not normally need to change IP tables rules on a regular basis (i.e. frequently at runtime). Therefore calling /sbin/iptables should be fine.

If you're trying to do this, then probably you need to look at an alternative match or target module which contains its own intelligence, or use NFQUEUE to queue the packets into a userspace program which can make its own decision based on criteria which can change as often as it likes (beware of sending too many packets into userspace, it's a potential performance problem)