Do firewalls always run in userspace?

Question

There are many Firewall solutions for the world on different operating systems: iptables, pf, ipfw.

My question is: Does the firewalls run in kernel-space or all of them runs in user-space? (in general, not just the mentioned ones)

Answer 1

It depends on your definition of firewall, and you're definition of run.

The actual packet interception is done in kernel space, before the packets are seen by any user programs. The network stack is in the kernel, so naturally filtering on that network stack also has to be in the kernel. You could build a userspace network stack, but it's a lot of work with no real benefit, and nobody does that anymore.

So by that definition, all modern firewalls run in kernel space.

Except that there are userspace programs for managing the firewall rules. The word iptables refers sometimes to the "netfilter" component of the kernel, and also a userspace program called iptables for managing netfilter rules. There are similar stories for other OSes.

But it gets even muddier because most modern OSes support the ability to send packets to a usespace tool for inspection, modification, etc. So while the initial interception happens in-kernel, the kernel outsource part fo the firewall tasks to userspace programs.

And even less clear when it comes to what qualifies as a "firewall". From a purist point of view, a firewall runs at layer 3^† it can do basic state tracking for TCP and can even scan for FTP port associations, but it's not parsing HTTP requests. That's not to say that a box you've designated as "the firewall" can't do it, though. It's not uncommon to associate a "firewall" device with a transparent HTTP proxy and cause all sorts of headaches for your users in the name of security. This, of course, is definitely not in-kernel. That's not to say that it couldn't be. But nobody does.

^{†: In addition to iptables, there's also ebtables, which does the same thing but for ethernet frames.}

Answer 2

It depends, most firewall software use the available kernel-level interfaces to track connections, but the actual management and rulesets are defined within userspace.

Answer 3

Most firewall run in kernel space. I know iptables and pf run in kernel space, and you can hook user-space applications to do additional magic on the traffic inspected.

You can for instance configure iptables to send packets to a userspace process such as suricata ids using NFQUEUE.

Other firewalls (Check Point) filter the packets before they reach the OS network stack. This is to increase performance of a firewall, and iptables is not really interesting to Check Point software as they have their own firewall.

Answer 4

Firewalls can run on both user spaces (Ring 3 OR Ring 0) however Ring 0 is preferred as firewalls can observe all network connections or incoming connections before an malware initiates it or bypasses the firewall using lower level network functions (LSP example.)

Firewalls use network sniffers to heuristically detect malware, which could be run on Usermode, but other firewalls use detours\hooks to intercept all network activity and analyse them and this normally is run on kernel as malwares cannot bypass its detours or even unhook it.

So to conclude they can run on any ring or even on both.

Answer 5

It depends on the capabilities of a firewall, especially how deep the inspection is:

• packet filters like iptables run in kernel space, but they mostly care about source and destination and will not inspect the content (yes, they can do this a bit, but this is usually easily circumvented)
• IDS like snort, bro or suricata run in user-space. While not strictly firewalls they can be used to inspect traffic and cause blocking of connections etc.
• Application level gateways (e.g. proxies) run in user-space. They are able to not only inspect data, but to change them, e.g. to filter out bad traffic or normalize uncommon and thus potentially harmful construct. A virus scanner, which is part of most enterprise firewalls, runs in user space too.

Just an example: Sophos UTM uses iptables as the packet filter (kernel), but uses also an HTTP proxy (user space) and an IDS (snort, user space too) to log or filter potential problems.

In summary, in kernel space you do usually only the simple stuff of filtering by source and destination, the more complex stuff is done in user space but might "talk" to kernel space to block specific connections.