Understanding "forward" in linux

Question

Which part of the linux is responsible for "forwarding" traffic between interfaces?

I know about "/proc/sys/net/ipv4/ip_forward" but which part of OS, kernel or a module is actually checking this setting and decides whether or not perform the forwarding?

Is kernel sitting there and mindlessly forwards any received packet which is not addressed to this machine to another interface based on routing table?

This is a very fundamental question that I always wanted to deeply understand.

Answer 1

Which part of the linux is responsible for "forwarding" traffic between interfaces?

The IP network stack. All the IP protocols - UDP, TCP, etc - run off the same fundamental routing tools and behaviours. This is also true of IPv6, which has a marginally different implementation but fundamentally the same architecture.

Is kernel sitting there and mindlessly forwards any received packet which is not addressed to this machine to another interface based on routing table?

Yes. Except the "mindlessly" part, where you meant to say, "as designed".

The process is simple: when a machine that confirms to the IP specification receives a packet, it makes some very simple decisions; the basic process is:

1. Validate that this is a sane packet.
2. Check if it is destined for a local IP address, and deliver locally if so.
3. Find the next hop from the routing table.
4. Send the packet to that next hop, or send an "undeliverable" error.

The ip_forward(...) method is invoked as part of that overall algorithm, and is as simple as you might think. IP is, fundamentally, a very, very simple protocol.