<story><title>BPF port-based firewall for systemd services</title><url>https://kailueke.gitlab.io/systemd-bpf-firewall-loader/</url></story><parent_chain></parent_chain><comment><author>ldng</author><text>Maybe someone can enlighten me because I&amp;#x27;m failing to see the relevance of SystemD here.&lt;p&gt;So the idea is, instead of having a central firewall managing all the host rules, each service define it&amp;#x27;s own firewall policy ? How do I override a policy ?&lt;p&gt;I maybe missing something but somehow I&amp;#x27;m not sure it&amp;#x27;s the right place to do this.&lt;p&gt;I&amp;#x27;ll end up joining the camp of SystemD does too much and breaks a lot of POSIX semantics making Linux systems hard to debug.&lt;p&gt;Lately it&amp;#x27;s been getting more and more in my way. Things that I have problems with lately, DNS, cgroup and namespace. Every time I&amp;#x27;ve lost a considerable amount of time because of poorly documented and mostly unexpected SystemD behavior.
Color me annoyed.&lt;p&gt;Edit: Hum, well, wasn&amp;#x27;t supposed to but it end up into a rant</text></comment>
<story><title>BPF port-based firewall for systemd services</title><url>https://kailueke.gitlab.io/systemd-bpf-firewall-loader/</url></story><parent_chain></parent_chain><comment><author>nailer</author><text>If you&amp;#x27;re wondering what BPF is: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;linux-audit.com&amp;#x2F;bpfilter-next-generation-linux-firewall&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;linux-audit.com&amp;#x2F;bpfilter-next-generation-linux-firew...&lt;/a&gt; and &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Berkeley_Packet_Filter&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Berkeley_Packet_Filter&lt;/a&gt;</text></comment>