netfilter.org (netfilter/iptables project)

netfilter is a community-driven, free and open-source project providing packet filtering software for Linux 2.4.x and later kernels. It addresses the need to filter packets, perform network address and port translation, log packets, queue packets to userspace, and otherwise manipulate traffic. The netfilter hooks form a framework inside the Linux kernel that lets kernel modules register callback functions at points along the network stack, invoked for each packet passing through.

The project is commonly associated with iptables, a generic firewalling tool where rules combine classifiers (matches) with an action (target), and its successor nftables, which offers more flexible and scalable packet classification. Capabilities include stateless and stateful filtering for IPv4 and IPv6, NAT/NAPT, packet logging, userspace queueing, and header manipulation such as altering TOS/DSCP/ECN bits. nftables provides a single tool with consistent syntax, transactional kernel-side ruleset updates, configurable base chain hooks and priorities, ingress and egress hooks, flowtables, and JSON input and output for scripting. Supporting libraries and tools include libnftnl, libnfnetlink, libmnl, libnetfilter_conntrack, libnetfilter_queue, libnetfilter_log, conntrack-tools, ipset, ulogd, and xtables-addons.

The project is intended for system administrators and developers building internet firewalls, highly available firewall clusters, NAT and masquerading setups, transparent proxies, and QoS or policy routing configurations. Software is released under the GNU General Public License version 2 (GPL-2.0) and compatible licenses, with licensing terms specified individually for each library and userspace tool.