Why BPF replacing iptables
BPF comes to Firewalls - LWN article - Jonathan Corbet 2018 April 17, 2018 Why is the kernel community replacing iptables with BPF? DEEP DIVE original article from https://cilium.io/blog/2018/04/17/why-is-the-kernel-community-replacing-iptables/ Author Note: this is a post by long-time Linux kernel networking developer and creator of the Cilium project, Thomas Graf The Linux kernel community recently announced bpfilter , which will replace the long-standing in-kernel implementation of iptables with high-performance network filtering powered by Linux BPF, all while guaranteeing a non-disruptive transition for Linux users. From humble roots as the packet filtering capability underlying popular tools like tcpdump and Wireshark, BPF has grown into a rich framework to extend the capabilities of Linux in a highly flexible manner without sacrificing key properties like performance and safety. This powerful combination has led forward-leaning users of Linux kernel...