Building a Hypervisor Firewall with nftables and Rust
summary
Builds a working hypervisor firewall using nftables and Rust that leverages nftables-json schema and Rust types to emit JSON commands and get compile‑time checked rules, and a daemon that atomically updates only affected objects. Uses nftables features — sets, maps, concatenations, ingress/prerouting/forward hooks and CT marks per interface — to implement constant‑time ACLs across hundreds of tap interfaces, dynamic connection limits (example: drop when per‑source conntrack > 20), bandwidth groups, and shows Red Hat data where throughput stays flat versus iptables as rules scale.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 3:56nftables rules structure
- 9:58Hypervisor networking
- 17:49Outgoing VM traffic security
- 23:27East-West and North-South filtering
- 27:45Dynamic firewall with Rust
- 30:11Q&A
related talks
31mBuilding a Hypervisor Firewall with nftables and Rust
22mFirewalld Changes Coming to Your OS
28mInterfacing Rust with Xen
35mEbpf with Rust: The Journey of a Package
22mRewriting the Rules: Why Kubernetes Is Moving To NFTables
12mAutomated Synthesis of Verified Firewalls
33mNetwork ACLs Made Easy: Establishing Zero Trust Network Policies in a Few C...
34mStop the Noise: Build Your Own Smart App Firewall with Rust and Pingora