While standard nftables rules are processed by the system's CPU, kmod-nft-offload allows the kernel to "offload" established network flows directly to compatible Network Interface Cards (NICs). This means once a connection is verified and established, the hardware takes over the heavy lifting, bypassing the CPU for subsequent packets in that stream. How Flow Offloading Works
Future packets for that connection are switched or routed entirely within the NIC hardware. This drastically reduces CPU utilization and lowers latency. Key Benefits
table inet filter { flowtable f { hook ingress priority 0 devices = { eth0, eth1 } } chain forward { type filter hook forward priority 0; policy accept; ip protocol { tcp, udp } flow offload @f } } Use code with caution. When to Use It kmod-nft-offload
To utilize kmod-nft-offload , you typically need three things:
Modern Linux kernels (5.x and above) have the core infrastructure, but the specific kmod package ensures all dependencies are met for your specific distribution. While standard nftables rules are processed by the
High-traffic gateways that move massive amounts of data between networks.
Processing packets in specialized silicon is generally more power-efficient than using general-purpose CPU cycles. Prerequisites and Compatibility This drastically reduces CPU utilization and lowers latency
In the world of modern Linux networking, efficiency is everything. As multi-gigabit connections become standard, the overhead of processing every packet through the CPU can become a significant bottleneck. This is where comes into play—a kernel module designed to bridge the gap between high-level firewall rules and high-speed hardware processing. What is kmod-nft-offload ?
Not all NICs support flow offloading. You generally need enterprise-grade hardware from vendors like Mellanox (Nvidia), Intel, or Netronome.
When a new connection (like a TCP handshake) arrives, it is processed by the CPU. The nftables engine checks the rules, determines if the traffic is allowed, and sets up a connection tracking entry.