How does a firewall software intercept network communication?

Question

I have a basic idea of what a software-based packet filter does, and I'm not sure if it's entirely accurate. Basically, a packet filter is a loadable kernel module that is inserted into the network stack between the network layer and the transport layer and tells the kernel "Instead of sending incoming packets to the transport layer, send them to me first, and I will decide whether to forward them or not. Also, do the same thing with outgoing packets."

My two questions are:

1. Is my idea accurate,
2. How does the packet filter get the kernel to listen to it and bypass its normal packet forwarding behavior, sending all packets to the filter instead?

I'm curious about how such a firewall would actually be implemented (at an abstract level; I'm aware I could just look at the source code for a firewall, but that would be rather tedious).

Answer 1

It is not the packet filter which gets the kernel to listen to it, it is the kernel which entrust network data to the packet filter.

The packet filter and the kernel must be compatible, technically speaking the kernel must offer specifics hooks used by the packet filter to do its job.

On Linux for instance, behind iptable front-end you will find that the Linux kernel offers hooks allowing the Netfilter framework to register callback functions:

• If the firewall is not enabled, there will be no callback registered so the kernel will handle everything by default,
• If firewall is enabled, Netfilter will have registered its callback functions so the kernel will be able to call them when appropriate.

Answer 2

Electrical signals transmitted along the RX/TX wires are read by the network card and translated/transmuted upwards the stack into kernel space where it is interpreted by netfilter. If you lsmod, you can find the kernel modules that do this. Netfilter hooks provide a way to cross from kernel space to user space programs.

It's pretty well worn by now, so the concept of a firewall is a filter based ruleset that can interact with the packet device.

Answer 3

It should be noted that in many cases "firewall software" is just a front-end for the firewall features built in to the kernel. For example, in ufw a rule like ufw deny 22 tells the kernel to drop packets addressed to port 22. ufw never sees the packets. If you need to do really advanced stuff not already available in the kernel your options depend on the specific kernel.

Linux for example offers netfilter hooks (where your code is a kernel module) and tproxy (where your code runs as a normal user-space process). Windows offers the Windows Filtering Platform (usable both in kernel-space and user-space), as well as several legacy APIs. The specifics vary a lot between OSes and APIs. In some cases the filtering application accepts connections using an almost normal socket listener. In other cases you register a function which will be passed a pointer to a packet in memory that it can modify.

TLDR: it can work in many different ways.