Building a Hypervisor Firewall with nftables and Rust
summary
Shows how nftables uses maps, sets and concatenations to get constant-time lookup so one rule scales across hundreds or even a thousand tap interfaces, and how conntrack marks mapped from interface names tag per-VM flows. Demonstrates preventing ARP spoofing and dropping rogue DHCP by matching UDP port tuples in a set, enforces per-source connection limits (example threshold 20) with dynamic sets and ADD, and implements bandwidth groups. Builds a Rust daemon that models the nftables JSON schema for compile-time-checked rule generation and issues atomic partial updates; Red Hat data shows nftables throughput stays flat where iptables degrades.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 3:56nftables rules structure
- 9:58Hypervisor networking
- 17:49Outgoing VM traffic security
- 23:27East-West and North-South filtering
- 27:45Dynamic firewall with Rust
- 30:11Q&A
related talks
31mBuilding a Hypervisor Firewall with nftables and Rust
35mEbpf with Rust: The Journey of a Package
22mRewriting the Rules: Why Kubernetes Is Moving To NFTables
45mTo the tables! Routing efficiently with iproute and Netfilter
22mFirewalld Changes Coming to Your OS
28mInterfacing Rust with Xen
34mMove fast and don't break things: High-performance networking in Rust
12mAutomated Synthesis of Verified Firewalls