Dual-layer protection

Your rules. Two kernel layers. One panel.

XDP comes first: stateless, dropping volume before the kernel (up to 256 rules per interface). nftables takes over: stateful, inspecting the connections that get through. You build both on the same page, without writing a line of kernel syntax.

Deploy a rule See the monitoring
256
XDP rules / interface
10M+
packets/s XDP
0
downtime on change
app.pakkt.io/protection · XDP & nftables rules ● LIVE
XDP · eBPF

Stateless. Before the kernel.

XDP runs your filtering logic inside the network driver, before any memory allocation. It is the layer that absorbs volumetric attacks without loading the CPU.

  • ✓block: immediate drop by port range and protocol.
  • ✓rate_limit: a global cap on the port and a per-source-IP cap, used together.
  • ✓allow_only: only lets a defined perimeter through.
  • ✓IP whitelist / blacklist in eBPF map, UDP anti-amplification, packet-size filtering.
Example · full defensive combo
typerate_limit
port30120 / UDP
max pps · port200,000
max pps · per IP5,000
Caps the port's total throughput and prevents a single IP from monopolizing the quota. Both limits drop independently.
nftables

Stateful. After the kernel.

nftables handles what XDP let through: connection tracking, TCP flags, per-connection rate limit. This is the layer that catches application-level attacks and bruteforce.

  • ✓SYN flood: protection via conntrack and limit.
  • ✓SSH bruteforce: per-IP rate limit on the admin port.
  • ✓accept / drop / reject / limit actions, on the input, forward, output chains.
  • ✓Isolated table "inet pakkt": zero conflict with Docker or your rules.
Per-rule counters

Every rule, XDP and nftables alike, exposes its own counters of passed and dropped packets. You see the measured effectiveness of each line of defense, down to the packet.

syn_flood_guard
74M drop
allow_voip
44M pass
ssh_ratelimit
92M drop
No kernel syntax

Ready-to-deploy templates, or described in plain English.

Template marketplace

77 XDP + nftables templates covering gaming (FiveM, Source, Minecraft), anti-flood, anti-amplification, VoIP, infra. One-click deployment, then fine-tuning.

AI assistant

Describe the rule in plain language ("limit port 30120 to 5000 packets/s per IP") and the assistant generates the matching XDP or nftables configuration.

Keep going

Explore the platform

Real-time monitoring Live dashboard, GeoIP world map, top IPs and ports. Discover → Auto Shield Automatic attack detection and IP banning. Discover → Geo-blocking Allow or block traffic by country, via CIDR sets. Discover → Proven effectiveness The same attack, with and without PAKKT. Discover →
FAQ

Frequently asked questions

Straight answers, no marketing fog.

What is the difference between the XDP layer and the nftables layer? expand_more
XDP is stateless and runs before the kernel network stack: it drops volume at the earliest possible point, making it ideal against floods. nftables is stateful and runs afterwards: it inspects connection state (conntrack), TCP flags, and applies per-connection rate limiting. XDP eliminates the bulk, nftables intelligently filters the rest. Both are managed from the same panel.
How many XDP rules can I create per server? expand_more
Up to 256 simultaneous XDP rules per network interface. Each rule occupies a slot in the eBPF engine and defines a port range, a protocol (TCP, UDP, ICMP or all), a type (block, rate_limit or allow_only) and its throughput limits. A single XDP program is loaded per interface; adding or removing a rule requires no reload.
Can I rate-limit a port globally AND per IP at the same time? expand_more
Yes. A rate_limit XDP rule accepts two independent limits: a global cap on the port (across all IPs) and a per-source-IP cap. Both can drop. Combined, they cap the absolute volume (for example 200,000 pkt/s on the port) while preventing any single IP from monopolizing the quota (for example 5,000 pkt/s per IP).
Do PAKKT rules conflict with Docker or an existing firewall? expand_more
No. XDP runs before iptables/nftables in the kernel, so it never touches your rules. PAKKT's nftables rules live in an isolated "inet pakkt" table, separate from Docker, fail2ban and your own tables. Docker's iptables chains are never modified.
Do I need to know XDP or nftables syntax to create a rule? expand_more
No. Everything goes through forms in the panel. A marketplace of ready-to-use templates (gaming, anti-flood, rate limit, anti-amplification, ICMP, VoIP) covers the common cases, and an AI assistant generates the configuration from a plain-language description.

Deploy your first rule in 2 minutes.

From 3 € / server / month. Marketplace template or custom rule, applied live, with no downtime. Free 7-day trial.

Deploy my first rule Automate with Auto-Shield