3 ms·
what's the user case for this and how does this complements iptables? why do I need this? BPF is very interesting, I remember one thing is that it's of very sm
by ausjke 7y ago
what's the user case for this and how does this complements iptables? why do I need this?
BPF is very interesting, I remember one thing is that it's of very small size and has no loops, but I don't understand its use case for firewall yet.
- jimktrains2 7y agoMy understanding is that it allows you to write a program to decide what to do with a packet and allow that program to run in kernel space for efficiency. The limitations of bpf are to protect the kernel from the non-kernel code running in its memory space and ring 0.
- Klasiaster 7y agoThere is already support in systemd for IP address filtering, so that a service can or cannot communicate with certain IPs. Internally this uses BPF as well. The blogpost was about extending this to port filtering through a custom BPF program.
- arianvanp 7y agoThis is a good talk about the how's and why's of BPF as a firewall: https://youtu.be/_Iq1xxNZOAo https://youtu.be/_Iq1xxNZOAo