NETWORK SECURITY

eBPF Firewall

Enforce network rules near the Linux packet-processing path. Host agents coordinate kernel programs and policy maps, while the control plane provides configuration and enforcement visibility.

CAPABILITIES

What it provides

  • XDP filtering at the network interface and supported TC attachment points.
  • Address, protocol, and port policies for the services on a host.
  • Supported source-rate controls and kernel-map enforcement.
  • Central configuration with host-level network and enforcement events.

DEPLOYMENT WORKFLOW

How to use it

  1. 01

    Deploy a Linux host agent with the required privileges, kernel support, and BTF.

  2. 02

    Connect it to the project using a provisioned client certificate and review program attachment status.

  3. 03

    Configure firewall policies for the intended interfaces and validate connectivity before broad enforcement.

CONFIGURATION & OPERATION

Where it fits in your setup

Use the project Firewall and Hosts pages to inspect agent state and configure supported network controls. Native XDP attachment depends on the network driver; actual performance depends on mode, hardware, and policy.

COVERAGE & LIMITS

What to account for

eBPF is Linux-specific and requires compatible kernel capabilities. Packet filtering cannot interpret every application behavior or replace L7 inspection. Carefully scope network policies to avoid disrupting administrative or application traffic.

Put the policy into practice.

Follow the documentation and validate with your own workload.

Open documentation →