XDP hooks into the NIC driver — the earliest possible point in the Linux packet path.
Unlike iptables or nftables, packets are evaluated before
the kernel networking stack, at wire speed. Auto XDP adds an auto-sync daemon that
watches which ports are actually open and updates the firewall rules in real time. Zero manual config.
Auto XDP combines wire-speed packet filtering, zero-config port sync, and a clean operator CLI into a single cohesive firewall daemon — designed for Linux hosts that can't afford to lose a microsecond.
Filters at NIC driver level before packets enter the kernel stack. ~40–65 ns per-packet latency, 28× less CPU under flood.
XDP_DROPDaemon watches netlink for socket changes and updates BPF maps in real time. Zero manual firewall config.
zero configHuman-friendly /etc/auto_xdp/config.toml. Configure rate limits, trusted CIDRs, ACL rules, tunnels. SIGHUP hot-reload.
Loadable BPF slot handlers for GRE, ESP, SCTP, or custom protocols. axdp slot load gre or point at your own .o file.
proto-41 (SIT) traffic accepted only from configured sit4_endpoints. All other proto-41 sources dropped at line rate.
TCP SYN creates tracked state. TC egress records outbound flows so return traffic passes without reopening port holes.
tc egressSYN and UDP rate limits keyed per source IP, configurable by process name or IANA service. Aggregate caps available.
anti-brute-forceWhen XDP cannot attach, the same control plane drives a dynamic nftables ruleset. Auto port sync keeps working.
graceful degradationTerminal control for everything: axdp stats · axdp acl add · axdp trust · axdp slot load · axdp under-attack on · axdp log-level
Auto XDP runs entirely in the Linux kernel fast path. XDP hooks at the NIC driver level drop malicious traffic before it ever touches the network stack, while TC egress tracks outbound connections to seed the conntrack allowlist — all coordinated through pinned BPF maps shared between kernel programs and userspace daemons.
Full lifecycle: install → boot → kernel plane → BPF maps → userspace
The xdp_port_sync daemon watches listening sockets in real time using Linux Netlink Process
Connector. When a process opens or closes a port, the BPF maps are updated within milliseconds —
no manual firewall rules, ever.
Tested with a high-performance AMD EPYC™ 7Y43 attacker generating ~367k PPS / 188 Mbps of UDP flood against a 1 vCPU AMD Ryzen 9 3900X target over the public internet.
modprobe pktgen on the attacker, configure a 64-byte UDP flood
(pkt_size 64, clone_skb 100, count 10000000),
and compare top softirq usage with sudo axdp watch showing
live counter deltas on the target.
Personal cloud instances are constantly scanned and probed.
Every day, bots hammer SSH, random high ports, and anything that looks like it
might be an exposed service. Traditional firewalls like iptables work —
but they process packets after the kernel networking stack, adding latency and CPU overhead.
Worse, they require manual port management: every time you start a new service,
you have to remember to open the firewall.
I wanted something that hooks in at the NIC driver level — the earliest possible interception point — and manages itself. When you start a new process that binds a port, the firewall should already know. When that process exits, the port should close automatically.
The result is Auto XDP: an eBPF/XDP firewall that sits at wire speed and a
userspace daemon that keeps it honest. One install command. Zero ongoing config.
And if your kernel doesn't support native XDP, it falls back to nftables
automatically — so it works everywhere.