Sysadmin Article: Why is the kernel community replacing iptables with BPF?

eva2000 · Apr 18, 2018

Interesting article on why Kernel community is intending to replace iptables with BPF (bpfilter) https://cilium.io/blog/2018/04/17/why-is-the-kernel-community-replacing-iptables/

The Linux kernel community recently announced bpfilter, which will replace the long-standing in-kernel implementation of iptables with high-performance network filtering powered by Linux BPF, all while guaranteeing a non-disruptive transition for Linux users.
Click to expand...

One BPF to rule them all
The most recent development in the evolution of BPF is an exciting proposal to completely replace the kernel part of iptables with BPF in a way that is completely transparent to the user, i.e. existing iptables client binaries and libraries will continue to work.

You can find the upstream discussion on the Kernel mailing lists. The proposal is authored by Daniel Borkmann (Covalent), the networking maintainer David Miller (Redhat), and Alexei Starovoitov (Facebook). The proposal was covered by an LWN article that gives a great summary of the initial discussion.

The following graph as presented by Quentin Monnet at FRnOG 30 shows some early measurements of bpfilter in comparison with iptables and nftables. It shows both the software only BPF implementation as well as a hardware offloaded test:

These early performance numbers are incredible promising and an indication of the power of BPF. It must be noted that bpfilter and BPF itself will not solve the performance problems caused by iptables's use of sequential lists. Doing so will require native use of BPF such as done by the Ciliumproject.
Click to expand...

Log in / Register

Forums

Get the most out of your Centmin Mod LEMP stack

Sysadmin Article: Why is the kernel community replacing iptables with BPF?

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Get the most out of your Centmin Mod LEMP stack

Sysadmin Article: Why is the kernel community replacing iptables with BPF?

eva2000 Administrator Staff Member

.