Chapter 42. Using xdp-filter for high-performance traffic filtering to prevent DDoS attacks

Procedure

1. Load xdp-filter to process incoming packets on a certain interface, such as enp1s0:

   # xdp-filter load enp1s0

   Copy to Clipboard Toggle word wrap

   By default, xdp-filter uses the allow policy, and the utility drops only traffic that matches any rule.

   Optionally, use the -f feature option to enable only particular features, such as tcp, ipv4, or ethernet. Loading only the required features instead of all of them increases the speed of packet processing. To enable multiple features, separate them with a comma.

   If the command fails with an error, the network driver does not support XDP programs.

2. Add rules to drop packets that match them. For example:

   • To drop incoming packets to port 22, enter:

     # xdp-filter port 22

     Copy to Clipboard Toggle word wrap

     This command adds a rule that matches TCP and UDP traffic. To match only a particular protocol, use the -p protocol option.

   • To drop incoming packets from 192.0.2.1, enter:

     # xdp-filter ip 192.0.2.1 -m src

     Copy to Clipboard Toggle word wrap

     Note that xdp-filter does not support IP ranges.

   • To drop incoming packets from MAC address 00:53:00:AA:07:BE, enter:

     # xdp-filter ether 00:53:00:AA:07:BE -m src

     Copy to Clipboard Toggle word wrap

Procedure

1. Load xdp-filter to process packets on a certain interface, such as enp1s0:

   # xdp-filter load enp1s0 -p deny

   Copy to Clipboard Toggle word wrap

   Optionally, use the -f feature option to enable only particular features, such as tcp, ipv4, or ethernet. Loading only the required features instead of all of them increases the speed of packet processing. To enable multiple features, separate them with a comma.

   If the command fails with an error, the network driver does not support XDP programs.

2. Add rules to allow packets that match them. For example:

   • To allow packets to port 22, enter:

     # xdp-filter port 22

     Copy to Clipboard Toggle word wrap

     This command adds a rule that matches TCP and UDP traffic. To match only a particular protocol, pass the -p protocol option to the command.

   • To allow packets to 192.0.2.1, enter:

     # xdp-filter ip 192.0.2.1

     Copy to Clipboard Toggle word wrap

     Note that xdp-filter does not support IP ranges.

   • To allow packets to MAC address 00:53:00:AA:07:BE, enter:

     # xdp-filter ether 00:53:00:AA:07:BE

     Copy to Clipboard Toggle word wrap
   Important

   The xdp-filter utility does not support stateful packet inspection. This requires that you either do not set a mode using the -m mode option or you add explicit rules to allow incoming traffic that the machine receives in reply to outgoing traffic.