Is there any stateful user-space firewall for Linux? I'm looking for a firewall that doesn't rely on anything in Linux kernel (like iptables/netfilter) and works with raw packets.

  • A firewall, even in user-space would require the network stack to provide hooks from the kernel anyway to the user-space, which to my understanding would prove highly insecure, impractical and slow, in one word: dangerous. Unless you don't mind reimplementing the network stack in user space I'm afraid it's very unlikely to impossible. I need someone with more advanced knowledge to confirm though. – user86969 Feb 9 '15 at 13:01
  • Thank you, I'm planning to use Intel DPDK, so I really don't need the kernel stack. Firewall should work with raw packets. – Konstantin Feb 9 '15 at 13:03

iptables will allow you to route selected packets to usespace for additional processing. (In your case selected packets would possibly mean all packets.) I've not done this but man iptables has this to say on the matter:


ACCEPT means to let the packet through. DROP means to drop the packet on the floor. QUEUE means to pass the packet to userspace. (How the packet can be received by a userspace process differs by the particular queue handler. 2.4.x and 2.6.x kernels up to 2.6.13 include the ip_queue queue handler. Kernels 2.6.14 and later additionally include the nfnetlink_queue queue handler. Packets with a target of QUEUE will be sent to queue number '0' in this case. Please also see the NFQUEUE target as described later in this man page.)

and later,

NFQUEUE [...] is an extension of the QUEUE target. As opposed to QUEUE, it allows you to put a packet into any specific queue, identified by its 16-bit queue number. [...] it requires the nfnetlink_queue kernel support.

Of course, this doesn't give you stateful firewall support but at least you can get at the packets. This also uses iptables to get the packets out to you in the first place, which may be unacceptable.

  • Thank you for the reply. I know this. What I try to achieve is bypass kernel altogether with DPDK. So I can't use netfilter/iptables. – Konstantin Feb 9 '15 at 14:20
  • @Konstantin you're probably going to need to use the tap interface then. (See OpenVPN for one example of how this can be used to process packets entirely in userspace.) – roaima Feb 9 '15 at 14:21
  • tap is very very slow, it would be great to bypass the kernel altogether and do everything in user-space – Konstantin Feb 9 '15 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.