Linux pf based firewall

I saw a post in another forum about a Linux pf based firewall, apparently from one of the original developers from pfsense.

Shows his timeline as 2024 to today at this new venture, and Netgate before that. Since this offer VPP, it might be interesting to follow and see where it goes. No offense to VyOS, I still haven’t sat down to run through it and learn what I need to learn.

Some discussion has been that the above project looks like AI translated programming. Could be good, could be bad, depends on how it is used and how it is reviewed.

VyProjects is developing our own routing platform, built from the ground up on Debian 13.

While VyOS has been a great project, we’ve encountered some challenges with larger configurations, particularly lengthy commit times and, in some cases, lengthy reboot times. Rather than work around these limitations, we decided to take a different approach and build a router platform that better aligns with our goals.

We’ve been working hard on this project for quite some time. Development has taken longer than we initially anticipated, but we’re getting close to having something ready.

The platform is not yet fully featured, but it already provides the core functionality needed for a capable router and firewall:

  • nftables — Zone-based firewall
  • Kea DHCP
  • NTP
  • Unbound DNS
  • NAT
  • IPv4 and IPv6 support

A Note on AI-Assisted Development

We also want to address something that has become a legitimate concern in modern software development: “vibe coding.”

Yes, we use AI as a development aid. However, this is not a project where we simply prompt an AI, accept the output, and ship it.

AI is used to assist our developers with tasks such as research, troubleshooting, code analysis, and implementation. Every change is reviewed by our development team, and AI-generated or AI-assisted code receives additional scrutiny rather than being treated as authoritative.

Our goal is to use AI as another tool and another set of eyes, not as a replacement for engineering judgment, testing, code review, or accountability.

Ultimately, we are responsible for the code we ship, regardless of whether a human or AI helped write it.

There’s still plenty of work ahead, but we’re excited about the direction the project is taking and look forward to sharing more as we get closer to release.

3 Likes

I have always read that the Linux kernel was significantly slower than the BSD kernel when it came to packet filtering. Has the Linux kernel caught up or perhaps that BSD kernel assertion was never true? How does the Linux kernel perform at this task? xMAXIMUSx are you using the standard debian 13 kernel, or are you rolling your own?

1 Like

Standard Debian kernel. We are going to implement VPP to deal with the kernel limitations, but users will have to have the proper hardware to use VPP.

We will also have software offloading on firewall rules too so that it can use the fast path.

1 Like