NETFILTER ARCHITECTURE. FUNCTIONAL TESTING IN ALT OS

The article presents a practical study of the netfilter subsystem implementation in the Russian Alt OS. The relevance of the work is driven by the need to verify the correctness and completeness of fundamental network security mechanisms in domestic software. The research addresses the task of comprehensive functional testing of the netfilter architecture through its modern interface -- the nftables framework. A series of experiments was conducted on an isolated laboratory testbed simulating a corporate network segment. The testing covers key functionalities: packet filtering (ICMP, TCP, UDP), network address translation (NAT), packet header manipulation (mangle), and traffic management using rate limiting (limit) and stateless filtering mechanisms. Particular attention is paid to comparing the behavioral aspects of REJECT and DROP actions when blocking access. The results experimentally confirm the full correctness and predictability of all tested mechanisms. Load testing allowed for observing the impact of various filtering rules on the router's CPU load. A key practical result is the verification of the reference-standard implementation of netfilter in Alt OS, confirming its suitability for deploying mission-critical network infrastructure. The obtained data and testing methodology can be used for the certification and security audit of domestic Linux distributions. The study's conclusions indicate that the netfilter/nftables implementation in Alt OS is reference-standard and functionally identical to that in the standard Linux kernel. The presented results demonstrate the platform's readiness to serve as a foundation for building reliable and efficient corporate firewalls.