cppcoffee/ipblock: IP-Block is an IP firewall implemented using XDP. · GitHub

IP-Block is an XDP program, that is an IP firewall. use rules to allow/deny access to a range of source IP addresses.

Block ip behavior use XDP package drop.

$ git submodule init
$ git submodule update
$ make

After compilation, two executable programs are generated:

• src/ipblock-loader is XDP loader, which is used to load and unload XDP program.
• src/ipblock-rule is used to control the add and remove of rules.

attach the ipblock XDP program on the eth2

# ./ipblock-loader -d eth2

detach the XDP program for the eth2

# ./ipblock-loader -d eth2 -u

droping IP packets for the ::ffff:c612:13/128

$ ./ipblock-rule -a ::ffff:c612:13/128 -p deny

allow IP packets for the 192.168.31.0/24

$ ./ipblock-rule -a 192.168.31.0/24 -p allow

$ ./ipblock-rule -d ::ffff:c612:13/128
$ ./ipblock-rule -d 192.168.31.0/24

$ ./ipblock-rule -l

BPF and XDP Reference Guide

github libbpf

BPF Portability and CO-RE