GitHub Repository

Lightweight eBPF/XDP stateful firewall that auto-syncs listening ports and preserves return traffic. Zero-config, maximum defense.

117 starsPython

XDP firewall that auto-syncs open ports – built after my VPS got DDoS'd

Name: XDP firewall that auto-syncs open ports – built after my VPS got DDoS'd
Availability: InStock
Author: kennethhh

by kennethhh·Feb 27, 2026·1 point·0 comments

Visit Project View on HN

AI Analysis

●●●BangerWizardrySolve My ProblemDark Horse

XDP drops packets at NIC before kernel stack—beats fail2ban's kernel reaction cost entirely.

Strengths

•Operates at wire speed (~40–65 ns/packet), fundamentally faster than iptables/fail2ban by processing at NIC driver level.
•Automatic port sync via Netlink eliminates manual firewall rule maintenance—daemon watches ss output and updates BPF maps in real time.
•Solves a concrete pain point: the author's real fail2ban catastrophe (20k+ IPs, OOM panic) demonstrates the problem wasn't theoretical.

Weaknesses

•Upstream bandwidth saturation remains unsolvable—explicitly documented as no replacement for scrubbing services, limiting use to volumetric attacks below link capacity.
•Linux-only (kernel ≥4.18, Debian/Ubuntu), and Netlink Process Connector dependency may be missing or require custom kernel builds on some VPS providers.

Post Description

A few days ago, someone decided to DDoS the entire IP range of my Hong Kong VPS provider. fail2ban did its job a little too enthusiastically — banned 20,000+ IPs, ran the machine out of memory, and triggered a kernel panic. Great. :/ That's when I realized the problem: fail2ban lets packets hit the kernel stack first, then reacts. Under a real flood, that reaction cost alone is enough to kill the machine. I went down the XDP/eBPF rabbit hole — packets get dropped at the NIC driver level, before they even touch the kernel. The other thing that annoyed me was manually managing port rules, so I built a daemon that watches for new listening ports via Netlink Process Connector and updates the BPF whitelist automatically. What it does: ~34–65 ns/packet drop on KVM VPS, auto-syncs open ports, handles IPv6 extension headers, one-liner install. What it won't do: won't save you if your uplink is already saturated — not a replacement for upstream scrubbing.

Would love feedback, especially if something breaks on your setup. First time posting here — hello everyone!