Netfilter changes on Linux Kernel 2.6.24.x

Netfilter is the packet filtering framework under Linux 2.4.x and 2.6.x. We usually use it with IPTABLES under linux user space to build stateful or stateless firewall, network addres translation and of course network packet filtering.

There are some useful change that you can find on netfilter on linux-2.6.24.x "vanilla" source tree. Some additional features from netfilter patchlet repository has been merged into kernel stable source tree.

Some changes that you can easily notice inside the kernel Core Netfilter Configuration are connlimit option and time option.

By using connlimit, you can easily manage incoming or outgoing parallel connection from your host inside the kernel. Time option adds a "time" match, which allows you to match based on the packet arrival time (at the machine which netfilter is running ) or departure time/date (for locally generated packets)