xdpwall

A minimal XDP/eBPF firewall that filters packets at the driver level, bypassing the normal networking stack. Built for learning purposes only.

Current Policy

• Block all traffic from 8.8.8.8
• Allow only UDP port 53 (DNS), block all other UDP
• Block TCP port 80 (HTTP)

Build

Compile the eBPF object file:

clang -O2 -g -target bpf -D__TARGET_ARCH_arm64 \
  -I/usr/include \
  -I/usr/include/bpf \
  -c firewall.c -o firewall.o

Attach

Attach the firewall to a network interface:

sudo ip link set dev <interface> xdp obj firewall.o sec firewall

Monitor

Watch dropped packets in realtime:

sudo cat /sys/kernel/debug/tracing/trace_pipe

Detach

Remove the firewall:

sudo ip link set dev <interface> xdp off