Auto XDP

Automatically keep a Linux host's firewall policy aligned with the services actually listening on it.

📑 Manuals & Wiki

Auto XDP is a host-side firewall for public and self-hosted Linux machines. It discovers the TCP and UDP sockets that services are listening on and keeps the active filtering policy in sync. When the host supports it, Auto XDP uses XDP/eBPF. It falls back to nftables when XDP cannot be attached safely.

It is designed for per-host protection on VPSes, cloud instances, homelabs, and other Internet-facing Linux machines.

XDP only filters traffic that reaches the host's network interface. If an upstream link is already saturated by a volumetric attack, Auto XDP cannot remove that traffic. Large attacks still require upstream DDoS mitigation.

Why Auto XDP?

Static firewall rules drift as services come and go. Auto XDP watches listening sockets and updates the policy when a service starts or stops:

• A newly listening service can become reachable without a new manual rule.
• A stopped service no longer remains open because of an old rule.
• Native XDP can drop unwanted packets before they enter the normal Linux networking path.
• The same listener policy can use nftables when native XDP is unavailable.

This keeps the firewall tied to what the host is actually exposing, while leaving explicit controls for permanent ports, exclusions, trusted sources, and CIDR-based access rules.

Auto XDP compared with other firewalls

Solution	How it gets its policy	Where it filters	Who maintains the rules
Auto XDP	Host listening sockets, plus explicit overrides	XDP when available, nftables fallback	Auto XDP and the operator's overrides
nftables	Explicit rules	Linux networking stack	The operator or another automation tool
UFW	Explicit rules through a simpler frontend	Its configured firewall backend	The operator or another automation tool
Raw XDP/eBPF	Custom program logic	XDP ingress	The program author

Auto XDP is a good fit when a single Linux host needs a default-deny inbound policy that follows service lifecycle changes. It is not a replacement for upstream filtering, and it does not remove the need to understand which services should be public.

Requirements

• Linux. Native XDP currently requires kernel 5.10 or newer.
• Python 3.10 or newer.
• sudo access.
• One of the supported distributions: Debian/Ubuntu, Fedora/RHEL, openSUSE, Arch, or Alpine.
• nftables for the fallback backend.

The installer checks and installs the required toolchain, including clang, llvm, libbpf, bpftool, and iproute2, on supported distributions. See the compatibility notes before installing on a production host.

Installation

Quick Install

Install the latest published release:

(
  set -e
  # quick-install-version:start
  AUTO_XDP_VERSION=v26.8.13a
  # quick-install-version:end
  auto_xdp_tmp=$(mktemp -d)
  trap 'rm -rf "$auto_xdp_tmp"' EXIT
  curl --proto '=https' --proto-redir '=https' --tlsv1.2 -sSfL \
    "https://github.com/Kookiejarz/Auto_XDP/archive/refs/tags/${AUTO_XDP_VERSION}.tar.gz" \
    | tar -xz -C "$auto_xdp_tmp" --strip-components=1
  cd "$auto_xdp_tmp"
  sudo bash setup_xdp.sh
)

The release archive keeps the installer, build inputs, Python runtime, and handlers on the same tag. For a source install, use the steps below.

Install from source

git clone https://github.com/Kookiejarz/Auto_XDP.git
cd Auto_XDP

# Preview the detected OS, init system, packages, and interfaces
bash setup_xdp.sh --dry-run

# Auto-discover active host ingress interfaces
bash setup_xdp.sh

To select an interface explicitly:

bash setup_xdp.sh eth0

To protect all active non-loopback interfaces:

bash setup_xdp.sh --all-interfaces

For release archive installation, upgrades, backend selection, and recovery, see Installation and Upgrade.

Common commands

# Show the active backend and its health
sudo axdp backend

# List ports allowed by the current policy
sudo axdp ports

# Show packet counters
sudo axdp stats

# Open the live terminal interface
sudo axdp tui

A quick check of automatic synchronization:

sudo axdp ports
python3 -m http.server 8080 &
sudo axdp ports
kill %1

After the next policy sync, port 8080 should appear while the server is running and disappear after it stops.

Real-World Performance Benchmark

This historical benchmark simulates a volumetric UDP flood. An AMD EPYC™ 7Y43 server generated approximately 367k packets per second (188 Mbps) against a 1 vCPU AMD Ryzen 9 3900X instance protected by Auto XDP.

Metric	Auto XDP off	Auto XDP on	Improvement
Softirq CPU usage	85.9%	3.0%	~28× reduction
System responsiveness	Extremely laggy	Smooth	Significant
Packet handling	Kernel networking stack	Driver-level drop	—

The result shows the expected difference between processing the flood in the kernel networking stack and dropping it at the XDP hook. It is a historical measurement, not a current performance guarantee; hardware, kernel, driver, traffic shape, and XDP mode affect the result.

Test environment

• Attacker: AMD EPYC™ 7Y43 @ 2.55 GHz, approximately 367k PPS / 188 Mbps
• Target: AMD Ryzen 9 3900X @ 2.0 GHz, 1 vCPU, 1 GB RAM
• Tool: pktgen (Linux kernel packet generator)
• Attacker and target connected over the public internet

How to reproduce

Run on a disposable, privileged Linux host. Replace INTERFACE, TARGET_IP, and TARGET_MAC with the target values:

modprobe pktgen

PGDEV=/proc/net/pktgen/INTERFACE
echo "rem_device_all" > /proc/net/pktgen/kpktgend_0
echo "add_device INTERFACE" > /proc/net/pktgen/kpktgend_0

echo "count 10000000" > "$PGDEV"
echo "pkt_size 64" > "$PGDEV"
echo "dst TARGET_IP" > "$PGDEV"
echo "dst_mac TARGET_MAC" > "$PGDEV"
echo "clone_skb 100" > "$PGDEV"

Important behavior

Auto XDP treats a socket bound to a non-loopback or wildcard address, such as 0.0.0.0 or ::, as potentially public. Use discovery exclusions or explicit ACLs for private and management services. The Configuration Reference covers these settings.

Documentation

• Wiki home
• CLI reference
• Configuration reference
• Architecture and packet flow
• Security policies and rate limits
• Operations and troubleshooting
• Performance benchmark
• Testing and development
• Uninstall and recovery

Contributing

See CONTRIBUTING.md for contribution guidelines and local test commands.

License

MPL 2.0 © 2026 Yunheng Liu