DHCP relies on Ethernet broadcasts to function - meaning DHCP messages are received by every NIC on the subnet. So ... already not private. PF_PACKET is neede

DHCP relies on Ethernet broadcasts to function - meaning DHCP messages are received by every NIC on the subnet. So ... already not private. PF_PACKET is needed to look at those broadcasts because the system might not have an IP, so it can't use TCP or UDP sockets. PF_PACKET on Linux evidently ignores iptables. Good news: PF_PACKET requires root to use (more precisely, CAP_NET_RAW capability). So root processes can totally ignore your firewall. This doesn't matter because: - a firewall is really for managing external communications. If you have stuff running on localhost sending or receiving unwanted stuff, and you don't trust it, why is it running on your machine then? - root can already simply disable the firewall by removing iptables rules or adding ones. You can always move to IPv6 which uses multi-cast and self-generated link-local addresses, meaning PF_PACKET isn't necessary.