NetBSD packet filter

NPF is a layer 3 packet filter, supporting stateful packet inspection, IPv6, NAT, IP sets, extensions and many more. It uses BPF as its core engine and it was designed with a focus on high performance, scalability, multi-threading and modularity. NPF was written from scratch in 2009. It is written in C99 and distributed under the 2-clause BSD license. NPF offers the traditional set of features provided by packet filters. Some key features are: Stateful inspection (connection tracking). Including the full TCP state tracking. Network address translation (NAT): Static (stateless) and dynamic (stateful) translation. NAPT and other forms of port translation (e.g. port forwarding). Inbound and outbound NAT as well as bi-directional NAT. Network-to-network translation, including NETMAP and NPTv6. Carrier-grade NAT (CG-NAT) capability: known to serve over a million connections. Tables for efficient IP sets, including the longest prefix match support. Application Level Gateways (e.g. to support traceroute). NPF uses BPF with just-in-time (JIT) compilation. Rule procedures and a framework for NPF extensions (plugins). Extensions include: Rate limiting (traffic policing). Traffic normalization. Packet logging. Data Plane Development Kit integration. For a full set of features and their description, see the NPF documentation and other manual pages. You can try NPF-Router as a demo NPF+DPDK application, running a virtual test network with Docker containers.