Kmod-nft-offload Repack Page

If you need to log every packet for security, offloading will hide that traffic from the logger. 🔧 How to Enable It

The magic happens with a kernel flowtable . When a connection is deemed established, its matching criteria (a 5-tuple of IP addresses, ports, and protocol) and the associated action (such as forwarding or NAT) are translated into a "flow rule" and programmed into the network device. Once offloaded, the hardware itself identifies and forwards subsequent packets belonging to that flow, completely bypassing the main CPU's netfilter stack and drastically reducing processing overhead.

: Still relies on the main CPU to execute the shortcutted packet forwarding, meaning throughput is still ultimately bounded by CPU clock speed. Hardware Flow Offloading

In a standard software-based firewall, every packet that passes through the network interface must be examined by the CPU. The CPU looks at the packet headers, compares them against the firewall rules, and decides to accept or drop them. On high-speed networks (1Gbps, 10Gbps, or higher), this consumes significant CPU resources and can create a bottleneck. kmod-nft-offload

The kmod-nft-offload kernel module provides the necessary infrastructure to offload nftables rulesets to compatible network hardware (e.g., SmartNICs, switch ASICs). This report details its architecture, dependencies, performance implications, and deployment considerations. Enabling this module significantly reduces CPU load for high-bandwidth packet forwarding by moving flow processing from the Linux network stack to hardware.

: This command verifies that the necessary kernel module for flow offloading is loaded. It might return the following:

The kmod-nft-offload module is often part of a broader suite of modules that build the foundation for nftables to function: If you need to log every packet for

opkg install kmod-nft-offload

Despite its benefits, users often encounter technical challenges when deploying kmod-nft-offload :

After making these changes, restart the firewall: Once offloaded, the hardware itself identifies and forwards

Once installed, offloading is typically managed via the Luci web interface or the /etc/config/firewall configuration file: Navigate to Routing/NAT Offloading Check the box for Software flow offloading ⚠️ Comparison: Software vs. Hardware Offload Software Offloading ( kmod-nft-offload

kmod-nft-nat : Required for offloading Network Address Translation (NAT) operations.

To integrate seamlessly with OpenWrt's default nftables-based firewall ( fw4 ), you can create custom nftables configuration files. This example creates a hardware flowtable named pft and a custom chain lans that offloads flows to it. The flowtable and chain are then integrated into the overall fw4 processing flow.