This project implements a high-performance Linux kernel module that optimizes inter-network namespace communication and integrates a scalable in-kernel firewall.
It reduces packet traversal overhead by bypassing virtual bridges and enables efficient firewall rule management using Red-Black Trees.
- Direct packet reinjection using MAC-based routing
- Eliminates multiple virtual bridge hops
- Achieved ~71% latency reduction (1.74 ms → 0.51 ms)
- Implemented using Red-Black Trees
- O(log n) rule lookup vs iptables' O(n)
- Reduced CPU usage from ~89% → ~0.7%
- ioctl-based interface via character device
- Supports dynamic rule insertion/deletion from user space
- C (Linux Kernel Development)
- C++ (User-space application)
- Netfilter Hooks
- Linux Networking Stack
firewall.c→ Kernel module (routing + firewall logic)firewall_app.cpp→ User-space control application- Additional test utilities (UDP client, scripts, etc.)
- Significant latency reduction in inter-namespace communication
- High scalability under large rule sets
- Efficient CPU utilization compared to iptables