Network Security: nftables and eBPF

Updated

October 30, 2026

Network Security: nftables and eBPF

Host-level network security in modern Linux centers on two kernel technologies: nftables (the modern successor to iptables) and eBPF (programmable in-kernel sandboxes).

+-----------------------------------------------------------+
|                   Linux Packet Traversal                  |
|                                                           |
| Network Interface Card (NIC)                              |
|         |                                                 |
|         v                                                 |
| [ eBPF / XDP Hook ] -----> (Drop / redirect at line rate!)|
|         |                                                 |
|         v                                                 |
| [ nftables prerouting ] -> (Stateful Connection Tracking) |
|         |                                                 |
|         v                                                 |
| [ Local In / Forward ] --> [ Socket Layer / Applications ]|
+-----------------------------------------------------------+

nftables: Modern Packet Filtering

nftables unifies IPv4, IPv6, ARP, and bridge filtering into a single bytecode virtual machine. It eliminates the duplication and performance overhead of legacy iptables, ip6tables, and ebtables.

Writing a Production Firewall (/etc/nftables.conf)

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;

        # 1. Allow local loopback traffic
        iif "lo" accept

        # 2. Accept established and related connections (stateful)
        ct state established,related accept

        # 3. Drop invalid packets
        ct state invalid drop

        # 4. Allow ICMP ping (rate-limited)
        ip protocol icmp icmp type echo-request limit rate 5/second accept

        # 5. Allow SSH on port 22
        tcp dport 22 ct state new accept
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }
}

Enable the ruleset instantly:

# nft -f /etc/nftables.conf

eBPF and XDP: Line-Rate Defense

Traditional firewalls inspect packets after the kernel has allocated an sk_buff (socket buffer) data structure in memory. Under a massive Distributed Denial of Service (DDoS) attack, the CPU spends 100% of its time allocating and freeing sk_buff objects, crashing the host.

eXpress Data Path (XDP) runs an in-kernel eBPF bytecode program inside the network driver itself, before memory is allocated:

// A minimal XDP packet-drop filter in C
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

SEC("xdp")
int filter_malicious_traffic(struct xdp_md *ctx) {
    // Inspect packet headers directly in NIC ring buffer
    // Drop bad packets instantly in zero CPU clock cycles!
    return XDP_DROP;
}
char _license[] SEC("license") = "GPL";

With eBPF and XDP, a modest Linux server can filter over 20 million packets per second without breaking a sweat.