Husband. Father. Software engineer. Ubuntu Linux user.
Connect to your router via SSH and run the following commands: opkg update opkg install kmod-nft-offload Use code with caution. Step 2: Enable via LuCI Web Interface Open your browser and log into the . Navigate to Network > Firewall . Scroll down to the Routing/NAT Offloading section. Check the box for Software flow offloading .
Accelerating Network Performance with kmod-nft-offload in OpenWrt
Hardware offloading reduces the CPU overhead associated with managing large numbers of concurrent flows. For a load balancer distributing traffic across multiple servers, the ability to handle hundreds of thousands of established connections without consuming CPU cores is a game-changer. kmod-nft-offload
This guide explains the functionality of this module and how it improves network throughput.
Advanced firewall features that rely on continuous packet inspection will not work on offloaded packets. This includes: Strict parental control time limits per byte Layer 7 protocol filtering (deep packet inspection) Detailed real-time bandwidth graphing per client Hardware Dependencies Connect to your router via SSH and run
kmod-nft-offload is a Linux kernel module designed to offload Network Functions (NF) to hardware, specifically network interface cards (NICs) that support nftables, a popular firewall and packet filtering tool. The module enables the Linux kernel to leverage the processing power of capable network hardware, reducing the CPU load and improving overall network performance.
:
Real-world reports confirm significant improvements. Users have reported achieving over 900 Mbps in speed tests when hardware offloading is working as intended, compared to much lower throughput when it is not.
The kmod-nft-offload package is a fundamental driver in OpenWrt's modern firewall4 architecture. It bridges the gap between software-defined network rules and high-speed execution environments by utilizing Linux kernel . Technical Specifications Scroll down to the Routing/NAT Offloading section
# Offloadable nft add rule inet filter forward oif "eth0" ip protocol tcp offload