Standalone Linux · local control plane · no cluster required

Firewall policy follows actual service state.

Auto XDP treats a Linux host's actual service exposure as the source of truth for firewall policy, then continuously reconciles that state into XDP when available or nftables when it is not.
service lifecycle follows exposure event + 30s safety reconcile native → generic → nftables standalone Linux ★ —
$ curl --proto '=https' --proto-redir '=https' --tlsv1.2 -sSfL https://github.com/Kookiejarz/Auto_XDP/archive/refs/tags/v26.8.13a.tar.gz | tar -xz --strip-components=1 && sudo bash setup_xdp.sh
The problem

The host changes.
The firewall forgets.

A standalone Linux server has a live service state and a separate firewall state. When an operator has to keep both aligned by hand, stopped services leave holes and new services break until someone remembers another rule.

0
Independent convergence paths
Netlink · relay · safety timer
0s
Full safety reconcile
repairs missed events and map drift
0
Shared control plane
XDP · generic XDP · nftables
The model

This is not one-time rule generation.

Auto XDP is a local reconciliation controller. It discovers the host's actual exposure, combines it with explicit exceptions, and keeps the effective policy converged as services change.

01 / observe

Actual host services

TCP listeners and server-style bound UDP sockets become the policy baseline.

02 / reconcile

Effective firewall policy

Fast events update state quickly. A full discovery pass repairs missed events and map drift.

+ permanent ports
+ trusted CIDRs and ACLs
+ discovery exclusions
03 / enforce

Safe dataplane

Native XDP first, generic XDP next, synchronized nftables when XDP cannot attach.

Policy is the product

XDP accelerates the policy. It does not define it.

The same socket discovery and reconciliation control plane drives every enforcement path. Losing native XDP support reduces acceleration, not protection.

PATH A

Native XDP

Preferred XDP-hook enforcement for unwanted ingress before the normal networking stack handles it.

PATH B

Generic XDP

Compatibility path that preserves the XDP policy model when native attachment is unavailable.

PATH C

nftables fallback

The same reconciler applies the effective policy instead of making operators maintain a second ruleset.

One policy. Multiple enforcement backends.

Engineering proof

Built for unattended hosts.

The deeper implementation exists to preserve policy continuity through reloads, missed events, backend changes, return traffic, and constrained single-host environments.

Early enforcement

When XDP is available, unwanted ingress is rejected at the XDP hook before it is passed into the normal kernel networking stack.

XDP_DROP
Continuous reconciliation

Fast socket events update policy quickly, while an independent full discovery pass repairs missed events and map drift.

event + timer
TOML Config

Human-friendly /etc/auto_xdp/config.toml. Configure rate limits, trusted CIDRs, ACL rules, tunnels. SIGHUP hot-reload.

SIGHUP reload
Protocol Plugins

Loadable BPF slot handlers for GRE, ESP, SCTP, or custom protocols. axdp slot load gre or point at your own .o file.

bpf_tail_call
6in4 Tunnel Guard

proto-41 (SIT) traffic accepted only from configured sit4_endpoints. All other proto-41 sources dropped at line rate.

proto-41
IPv4 + IPv6 Conntrack

TCP SYN creates tracked state. TC egress records outbound flows so return traffic passes without reopening port holes.

tc egress
Per-Source Rate Limits

SYN and UDP rate limits keyed per source IP, configurable by process name or IANA service. Aggregate caps available.

anti-brute-force
Safe degradation

When XDP cannot attach, the same control plane drives a synchronized nftables ruleset. Policy automation keeps working.

graceful degradation
axdp CLI

Terminal control for everything: axdp stats · axdp acl add · axdp trust · axdp slot load · axdp under-attack on · axdp log-level

operator CLI
CLI Preview

axdp in action.

The operator view exposes the reconciler's result: active backend, discovered services, policy limits, packet decisions, and the state that keeps legitimate return traffic moving.

$
axdp tui — stats · events · limits
axdp main stats and events view axdp top traffic by source
Manual overlays

Automation defines the baseline.
Exceptions stay explicit.

Use /etc/auto_xdp/config.toml for permanent ports, trusted CIDRs, ACL rules, discovery exclusions, and rate limits. The reconciler combines these overlays with actual listening sockets.

/etc/auto_xdp/config.toml 
# daemon behaviour
[daemon]
log_level         = "warning"
preferred_backend = "auto"          # auto · xdp · nftables

# port auto-discovery filters
[discovery]
exclude_loopback   = true
exclude_bind_cidrs = ["10.0.0.0/8"]  # skip private-only listeners
exclude_ports      = [5432, 6379]    # keep DB/cache off the public whitelist new

# ports always whitelisted regardless of discovery
[permanent_ports]
tcp = [22, 443]
udp = [53, 51820]

# IPs that bypass rate limits and the SYN whitelist check
[trusted_ips]
"203.0.113.5/32" = "monitoring"
"2001:db8::/32"  = "office-v6"

# explicit per-CIDR port allowances (TCP or UDP)
[[acl]]
proto = "tcp"
cidr  = "198.51.100.0/24"
ports = [5432, 6379]

# XDP data-path tunables
[xdp.runtime]
default_tcp_syn_rate      = 100   # SYNs/s per source (normal mode)
icmp_burst_packets        = 100
udp_global_byte_rate_mbps = 997
System Design

Architecture

The userspace reconciler observes host state and writes one effective policy. XDP and TC enforce and track traffic at the kernel boundary, while pinned BPF maps connect the control plane to the dataplane. The architecture is local: one server, one daemon, no central controller.

The difference

Most host firewalls start from manually declared rules; Auto XDP starts from observed service state and continuously reconciles enforcement to match it.

Control plane & pipeline: install → userspace reconciler → BPF maps → kernel enforcement

Auto XDP system architecture diagram
⚡ Dataplane deep dive: Live Packet Decision Path — XDP Firewall Core
🌐 Internet NIC Driver eth0 / enp3s0 — hardware RX queue ⚡ XDP HOOK — pre-stack enforcement XDP FIREWALL CORE L3 Pre-checks: VLAN · Fragment VLAN nesting > limit → DROP · IPv4 MF/offset · non-initial IPv6 frag → DROP DROP Bogon Filter (if enabled) bogon/reserved src → DROP · legit → continue to classifier DROP Protocol Classifier ETH → IPv4/v6 → L4 TCP UDP ICMP ARP / NDP proto-41 (SIT) MAP sit4_endpoints HASH · SIT endpoints hit→PASS DROP ── TCP PATH ── Malformed Packet Check NULL · XMAS · SYN+FIN · SYN+RST RST+FIN · bad doff · port=0 DROP MAP ACL · Trusted Src acl_map CIDR match → PASS trusted_ipv4/v6 LPM_TRIE → PASS hit→PASS SYN? yes MAP tcp_whitelist ARRAY[65536] SYN Rate Limit per-IP · per-port window MAP tcp_conntrack INSERT LRU_HASH[262144] no (ACK) MAP tcp_conntrack lookup (ACK flow) CT_MISS → DROP ICMP Token Bucket 100 pps burst · per-sec refill PASS DROP ARP/NDP PASS ── UDP PATH ── MAP udp_conntrack reply-tuple lookup hit→PASS MAP ACL Rules acl_map · match → PASS hit→PASS MAP trusted_ipv4/v6 LPM_TRIE · CIDR match hit→PASS MAP udp_whitelist ARRAY[65536] · server ports DROP UDP Rate Limit per-src · global sliding window XDP_PASS → kernel network stack XDP_DROP zero CPU overhead Kernel Network Stack TCP/IP · socket layer Your Application SSH · nginx · postgres … TC EGRESS tc_flow_track outbound SYN/UDP → conntrack seed MAP tcp_ct4 / udp_ct4 conntrack seed write seeds
Incoming packet
XDP_PASS
XDP_DROP
ICMP / rate-limited
ARP / NDP
Service lifecycle

Start a service. Exposure follows.

The xdp_port_sync daemon watches actual listening sockets. When a process binds a public port, the effective policy follows it. When the process stops listening, that exposure disappears.

Interactive demonstration: the events below are simulated UI data, not the visitor's host.

xdp_port_sync.py
tcp_whitelist ARRAY[65536]
udp_whitelist ARRAY[65536]
Know the boundary

Protection starts at the host.

Auto XDP is intentionally a local host firewall, not a replacement for upstream mitigation or multi-user authorization.

Not upstream DDoS mitigation.

XDP only filters traffic that reaches the NIC. If upstream bandwidth is saturated, use provider-side scrubbing or a protected host.

Not a multi-user authorization boundary.

A public or wildcard listener is treated as an explicit request for exposure. Use trusted hosts or configure discovery exclusions for stronger separation.

Not a cluster policy platform.

It is designed for one Linux server, one local daemon, and local kernel state without an API server or datastore.

Real-world test

Same flood. 28× less target CPU.

In a real public-internet test, XDP reduced target softirq CPU from 85.9% to 3.0% under an approximately 367k PPS / 188 Mbps UDP flood. Performance is an enforcement advantage, not the product thesis.

Auto XDP OFF
0%
softirq CPU — kernel processing every packet
Auto XDP ON
0%
softirq CPU — packets dropped at the XDP hook
How to reproduce:
Load modprobe pktgen on the attacker, configure a 64-byte UDP flood (pkt_size 64, clone_skb 100, count 10000000), and compare top softirq usage with sudo axdp watch showing live counter deltas on the target. This measures host-side filtering; it does not mitigate upstream bandwidth saturation.
Packet path comparison
TRADITIONAL AUTO XDP NIC Driver hardware RX CPU Kernel Stack socket buf · TCP/IP CPU iptables netfilter · late check DROP full kernel path wasted on every blocked packet NIC Driver hardware RX ⚡ XDP Hook XDP hook · pre-stack DROP ≈0 CPU PASS Kernel Stack legit traffic only Your App SSH · nginx · postgres drop at hook; pass continues through stack
Origin

Why I built this.

Standalone servers are constantly scanned and probed. Traditional firewalls work, but their static policy can drift from the services the host is actually running. A new service needs a remembered rule. A stopped service needs a remembered cleanup.

Auto XDP starts from a different premise: the host already knows which services it is exposing. When a process binds a public port, policy should converge. When it stops listening, that exposure should disappear without a second manual ruleset.

Auto XDP is an automatically reconciled host firewall for standalone Linux servers. XDP is the preferred acceleration layer, while generic XDP and nftables provide safer compatibility paths when the preferred backend is unavailable.

Operating principles
↻ Host state first. Actual listeners define the automatic exposure baseline.
↗ Converge continuously. Event paths react quickly while the safety timer repairs drift.
⇄ Separate policy from speed. One control plane can use XDP or nftables.
□ Fail safely. Transactional reloads preserve protection through backend and generation changes.
Project status

Open source, with a public trail.

Auto XDP is built in the open for people operating real Linux hosts: VPSes, cloud instances, homelab nodes, and small public servers. The repository is the source of truth for releases, implementation, tests, and the next contribution.

STATUS

Active releases

Tagged releases have landed across five consecutive months. Follow the trail, then inspect the changelog and CI-backed repository history.

131 GitHub stars
7 forks
214 commits
2 · 1 open issues · open PR
Release history
Aprv26.4.24a
Mayv26.5.30a
Junv26.6.10a
Julv26.7.7a
Augv26.8.13a
Support the project. Code, tests, docs, and hardware feedback all help strengthen the next release. Read the guide →