An eBPF Firewall for Linux Hosts: XDP and TC Enforcement Explained
eBPF moves packet filtering into the Linux kernel at XDP and TC. Here is what that means for host firewalling, enforcement and visibility — and its real limits.
A traditional host firewall does its thinking fairly late — the packet has already climbed a good way up the networking stack before a rule gets to say no. eBPF lets you make that decision much, much earlier, by running small verified programs down near the wire. For dropping junk before it costs you anything, earlier is better.
XDP and TC, without the jargon
Two attachment points matter here. XDP runs the instant the driver hands a packet to software, which makes it the right place for blunt allow/block calls and for shrugging off floods. TC sits on both ingress and egress, so it also sees what the host is sending — which is where egress policy and reply-aware handling have to live, because you can't reason about outbound traffic from the inbound side alone.
WAFio's host agent wrangles these kernel programs and their policy maps, while the control plane hands down configuration and gathers up the enforcement events. You manage address, protocol and port policy per host, from one screen.
The footgun nobody warns you about
An egress "deny all" or a wildcard block is powerful enough to cut your own SSH session out from under you, and then you're driving to the data centre. WAFio checks the intent before it applies anything: an ingress deny-all has to leave a permanent allow on a reported SSH port, and broad egress blocks require connection tracking plus a lockout-escape entry. If a bundle would lock you out, it's refused with a reason, and the agent holds onto its last good state. It's the kind of guardrail you don't appreciate until the one time it saves you.
It's not just a firewall
The same eBPF plumbing powers Runtime Security. You get execution, file and network events — execve, openat, connect and friends — with process and parent context, container details when a runtime socket is around, and detection rules that can suppress, escalate, downgrade or tag what comes through. Start in monitor or simulate, and move up to supported kill actions on matching processes once you trust what you're seeing.
What it can't do
No hand-waving here. eBPF is Linux-only and wants a recent kernel — WAFio's host-agent eBPF needs 5.10 or newer — with the right capabilities and BTF present. Packet filtering also can't read application behaviour, so this complements L7 inspection rather than replacing it. And native XDP throughput depends on your driver, your mode and your hardware; it's fast, but "fast" has fine print.
Layers, on purpose
Enforcement in the kernel, L7 inspection at the semantic WAF, and runtime visibility on the host — each one covers the blind spots of the others. That's the whole idea. Have a look at the eBPF Firewall feature, or see the pieces work together in the demo.