# Create a table with netdev family (best for forwarding offload) nft add table netdev filter nft add chain netdev filter ingress type filter hook ingress device eth0 priority 0; Add an offloaded rule: Forward all SSH traffic (port 22) to eth1 The 'offload' keyword is critical. nft add rule netdev filter ingress ip protocol tcp tcp dport 22 accept offload Add a default drop (cannot be offloaded, but CPU processes it) nft add rule netdev filter ingress drop Step 4: Verification Check if the rule actually resides in hardware.
In the world of Linux networking, the mantra has long been "software-defined flexibility." The nftables framework revolutionized packet filtering by replacing the older iptables with a more efficient, expressive, and stateful system. However, as network interface card (NIC) speeds climb from 10GbE to 100GbE and beyond, even the most optimized kernel networking stack struggles to keep up without consuming massive CPU resources.
sudo modprobe nft_offload # Verify it exists in kernel modules list lsmod | grep nft_offload Turn on the hardware offload feature for your interface.
