Kmod-nft-offload

kmod-nft-offload is a kernel module for OpenWrt that provides Netfilter nf_tables routing and NAT offload support. It is a core component for improving network performance by moving packet processing from the CPU to specialized hardware or optimized software paths. Key Features and Dependencies

Trade-offs / limitations:

1. A packet arrives at the NIC.
2. The NIC interrupts the CPU (or the driver polls the NIC).
3. The kernel's network stack parses the packet headers (L2/L3/L4).
4. The packet traverses the nftables hook chain (e.g., prerouting, forward).
5. If a rule matches, the action (accept, drop, NAT) is taken.
6. The packet is sent back to the NIC for transmission.

Lower CPU Load: By "fast-pathing" packets, the CPU usage drops significantly during heavy downloads, leaving more room for other tasks like VPN encryption (WireGuard) or SQM (Smart Queue Management).

Known limitations

• Only supports ** IPv4/IPv6 forwarding** paths (no local input offload yet)
• Does not offload log, queue, dup to, or stateful expressions like ct with limit
• Hardware table size limits apply

• L2/L3/L4 header matches: MAC, VLAN, IPv4/IPv6, TCP/UDP/ICMP, ports
• Connection tracking state for established flows (some NICs implement CT offload)
• NAT (source/destination IP/port rewrite) — partial support on more advanced NICs
• Forwarding/redirect (send to specific queue/port)
• Packet counters (bytes/packets)
• Basic QoS actions, encapsulation/decapsulation (on smart NICs)
• ACL-like rules and hash-based flow tables