ipchains

~ the goodbye ~

Before ipchains the Linux firewall was ipfwadm, which had been carried over from BSD and had the structure to show for it: a fixed set of rules in a fixed order, with no way to branch. Rusty Russell rewrote it. The code appears in kernel 2.1.102, released on 14 May 1998, and by the time 2.2.0 shipped on 26 January 1999 it was the only supported way to configure packet filtering on a Linux machine. The HOWTO he wrote to go with it is still at netfilter.org and still says, in the present tense, that the code is in the mainstream kernel from 2.1.102.

The idea in the name is the branch. There were three built-in chains, the busy ones being input for what arrived and forward for what passed through, and a packet walked whichever chain applied to it, rule by rule, until something accepted or denied it. The part that was new was that you could make your own chains and jump to them, so a ruleset could be organized by what it was about rather than written as one long list. Everybody who administered a Linux box between 1999 and 2001 typed these commands, usually out of a shell script run at boot that they had copied from somebody else and edited until the connection came back.

The other thing it did, and the reason most home users ever met it, was masquerading. One target, written -j MASQ, took every machine behind a Linux box and made their traffic appear to come from the single address the dial-up account had been given. That is how one modem line fed a second computer in the house, years before a router with a web interface was a thing you could buy at any electronics store.

Its replacement was already being written while 2.2 was shipping. Russell started the netfilter project in 1998, the code went into the mainline kernel on 26 August 1999 in version 2.3.15, and it reached everybody with 2.4.0 on 4 January 2001. The new command was iptables, the concepts were close enough that a working ruleset could be translated by hand in an afternoon, and the old one was finished.

~ the chronicle ~

~ the compatibility layer ~

ipchains did not vanish on the day 2.4 shipped, because far too much was configured with it. The kernel kept a compatibility module so that a 2.4 machine could still be driven by the old command, and there was an ipfwadm-wrapper shell script riding along to support the generation before that, which meant three firewall interfaces stacked on top of one filtering engine. The netfilter HOWTO was blunt about the cost of using it: slower, and it does not check its arguments properly.

That stack is what eventually got the old code killed. Maintaining the mid-level interface the compatibility layer needed was holding back cleanup work inside netfilter, and a netfilter workshop in Erlangen decided to remove it.

~ the man who deprecated his own code ~

The patch is dated 21 September 2004 and the author line reads Rusty Russell. What it adds to the kernel source is two lines:

#warning ipchains is obsolete, and will be removed soon.
#warning ipfwadm is obsolete, and will be removed soon.

It shipped in Linux 2.6.9 on 18 October 2004, so from that point anybody compiling the old firewall support got a message from the person who wrote it telling them to stop. The removal followed quietly: the file is gone from 2.6.12 in June 2005, which is the oldest kernel in the git history, so the exact commit that deleted it predates the version control everyone uses to look these things up.

~ what the books kept saying ~

By the time I was administering anything in Ankara, iptables was already the answer and ipchains was the thing in the documentation. That gap lasted for years. Printed Linux books stayed on the shelves long after their syntax was wrong, and the Turkish forums kept reposting whatever had worked for somebody in 2000. So I learned the command that was alive while most of the answers I found were written for the command that was dead.

Both of them lost eventually. nftables replaced iptables from 2014 onward, which makes ipchains the first of three layers in the same spot, each one written to clean up the mess the previous one made, each one outliving its own obsolescence by about four years because the configuration files are what people actually keep.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »