Use moat in front
To drop floods, bogus sources and known bad traffic before the stack spends anything on them, with rules you can read and test.
moat and the tools you filter with today.
iptables and nftables filter inside the network stack, where they can track connections. moat filters earlier, at XDP, where dropping a packet costs the least, and gives you a language, tests and tools that hand-written XDP programs leave to you.
| Topic | moat | iptables | nftables | XDP in C |
|---|---|---|---|---|
| Where packets are filtered | At XDP: in the driver, before the network stack, on NICs with native XDP | Netfilter hooks, inside the network stack | Netfilter hooks, inside the network stack | At XDP, the same hook |
| Connection state | None: every packet is judged on its own | Yes, with conntrack | Yes, with ct | Only what you build in maps |
| How rules are written | A small rule language in a .moat file | One command line per rule | The nft language | C, against the kernel helpers |
| Toolchain | One binary, no compiler | The iptables tools | The nft tool | clang, LLVM and a loader such as libbpf |
| Test before it touches traffic | Case files run in the kernel or in a model, and moat explain shows why | A syntax check (iptables-restore --test) | A syntax check (nft -c) | Your own harness around BPF_PROG_TEST_RUN |
| Rate limits per source | limit ... per ip.src or per network | hashlimit | Meters and sets with limit | Maps and timing code you write |
| Ban lists that fill themselves | add ip.src to a set with a ttl | ipset with timeouts, or recent | Dynamic sets with timeouts | Maps you write and expire |
| Change rules without a gap | reload swaps the program at once and keeps sets | iptables-restore replaces a table at once | nft -f applies a ruleset as one transaction | Up to your loader |
| NAT, forwarding, logging | No: moat only passes or drops | Yes | Yes | Redirect or bounce packets, by hand |
| Existing rules | moat import iptables and nftables | Not applicable | iptables-translate from iptables | Rewrite by hand |
Keep a stateful firewall behind it
iptables or nftables still own what needs state: established connections, NAT, forwarding and logging. moat cuts the volume they have to look at.
Write XDP in C when you must
When a program has to rewrite, bounce or redirect packets, or keep its own state, C is the tool. For pass or drop, moat writes and tests the program for you.