I have a basic idea of what a software-based packet filter does, and I'm not sure if it's entirely accurate. Basically, a packet filter is a loadable kernel module that is inserted into the network stack between the network layer and the transport layer and tells the kernel "Instead of sending incoming packets to the transport layer, send them to me first, and I will decide whether to forward them or not. Also, do the same thing with outgoing packets."
My two questions are:
- Is my idea accurate,
- How does the packet filter get the kernel to listen to it and bypass its normal packet forwarding behavior, sending all packets to the filter instead?
I'm curious about how such a firewall would actually be implemented (at an abstract level; I'm aware I could just look at the source code for a firewall, but that would be rather tedious).