🔥 QHTL Firewall: StarLinkGate XDP — Doomsday 🔥

Post by **daniel** » Fri Dec 12, 2025 4:11 am

QHTL Firewall: StarLinkGate XDP — When Packets Meet Their Doom at 25M PPS
From Dark Horizon to Light Speed: The Journey Nobody Asked For But Everyone Needed

Hey SkyRocket fam!

Grab your coffee

(or something stronger

), because this is going to be a ride. You know how we've been quietly cooking something in the lab since Dark Horizon? Well, the kitchen is on fire and we're serving it HOT.

TL;DR For The Impatient

25+ Million packets per second DROP rate
XDP (eXpress Data Path) — packets die before the kernel even knows they existed
Three modes: Generic, Native, Offload — pick your flavor of destruction
Works on Hyper-V, KVM, VMware, bare metal — yes, even your grandma's VPS
150MB+ throughput while filtering — legitimate traffic doesn’t even notice
IPv4 + IPv6 — we block everything equally

: starlink.png (74.08 KiB) Viewed 41 times

The Story: How We Got Here
Remember Dark Horizon? That was cute. iptables, nftables, connection tracking… like a bouncer checking IDs at the door. Effective, but the queue was getting long.
Then one night, fueled by energy drinks and questionable life choices, someone asked:

"What if we just… stopped the packets before they even got to the door?"

And thus began the journey into eBPF/XDP territory — where packets go to die faster than my motivation on Monday mornings.

What is StarLinkGate?
StarLinkGate is our XDP-based packet filtering engine. For the uninitiated:

Old way (iptables/nftables):

Code: Select all

Packet → NIC → Driver → Kernel Stack → netfilter → "You shall not pass!" → Drop

(Packet already toured half your RAM)

StarLinkGate way:

Code: Select all

Packet → NIC → XDP → "lol no" → Drop

(Packet didn’t even get a visitor badge)

The difference? About 10–100x performance. Not just closing the door faster — making the door not exist for bad actors.

The Three Modes of Destruction

Generic Mode (xdpgeneric) — Works everywhere, even ancient NICs. Fast (millions PPS).
Native/Driver Mode (xdp) — Runs in the NIC driver. Faster (tens of millions PPS).
Offload Mode (xdpoffload) — Runs on the NIC itself. Wire speed. CPU is literally sleeping.

Features That’ll Make You Weep (Happy Tears)

IP Blocklist at Ludicrous Speed — Up to 1M entries, O(1) lookup, 25M+ PPS drop rate.
Smart Port Filtering — Allowlist, blocklist, per-protocol rules. Script kiddies hit a wall.
SYN Flood Protection — Configurable per-IP SYN rate limiting. DDoS scripts cry.
Real-Time Statistics — Watch packets dropped, blocked, passed in live counters. Netflix for sysadmins.

The Bug That Almost Broke Us
Hyper-V Gen1 testing: Generic mode fine, Native mode killed outbound traffic.

[root@server]# curl google.com
*cricket sounds*
*tumbleweeds*
*existential dread*

Fix: Detect and pass response/egress packets in native mode. Three hours of debugging, one elegant solution, infinite relief. Moral: Always test on Hyper-V. Builds character (and gray hairs).

Benchmarks

Scenario iptables nftables StarLinkGate XDP
Empty ruleset 3M pps 4M pps 25M+ pps
10K IPs 1.5M pps 2M pps 25M+ pps
100K IPs 800K pps 1.2M pps 25M+ pps
1M IPs Still 25M+ pps

Real World Impact
Before StarLinkGate:

[DDoS at 5M pps] Server: "I need an adult" | CPU: 100% | Load: 847.32 | Users: "Is it down?"

After StarLinkGate:

[DDoS at 5M pps] StarLinkGate: *drops 5M pps casually* | Server: "What attack?" | CPU: 3% | Load: 0.42 | Users: "Site’s fast today!"

How To Get It
Already running QHTL Firewall? Update and restart:

Code: Select all

qhtlfirewall -u  
systemctl restart qhtlwaterfall

Enable StarLinkGate:

Code: Select all

qhtl_starlink load eth0

Native mode:

Code: Select all

STARLINKGATE_XDP_MODE = "native"

What’s Next

TC egress filtering
Connection tracking in XDP
GeoIP blocking at XDP level
Automatic attack detection with real ML

Credits & Thanks

eBPF/XDP community — making packets fear for their lives
Hyper-V — keeping us humble
Caffeine — for existing
Everyone who said "just use iptables" — look at us now

Final Words
They said it couldn’t be done.
They said iptables was enough.
They said XDP was too complex.

We said: "Hold my packet."

StarLinkGate: Where bad packets come to die, and your server doesn’t even know they existed.

Available now in QHTL Firewall 0.5.8

Questions? Comments? Want to share your DDoS mitigation stories? Drop them below!
And remember: Friends don’t let friends use fail2ban alone in production.

StarLinkGate_Manual.pdf: (197.01 KiB) Downloaded 9 times

#QHTL #StarLinkGate #XDP #eBPF #FirewallEvolution #PacketCarnage