The standard, native nftables approach designed for the newer fw4 (Firewall 4) in OpenWrt.
: The CPU processes only the initial packet of a connection. Once the connection is established, the module pushes the routing path directly into the network switch architecture or Network Acceleration Engine (PPE/NSS). Subsequent packets bypass the main CPU entirely. Key Benefits of Hardware Offloading
Maximizing OpenWrt Performance: An In-Depth Guide to kmod-nft-offload kmod-nft-offload
Turn on the hardware offload feature for your interface.
Beyond the basics, kmod-nft-offload can be integrated into various complex configurations. Here are a couple of practical examples: The standard, native nftables approach designed for the
Understanding kmod-nft-offload : Boosting Network Performance with Hardware Acceleration
Network Address Translation (NAT) and routing can bottleneck high-speed internet connections. Hardware flow offloading solves this issue by bypassing the main CPU. In modern Linux distributions and OpenWrt, the kmod-nft-offload kernel module is the key to unlocking this performance. What is kmod-nft-offload? Subsequent packets bypass the main CPU entirely
: Offloading usually works only for forwarded traffic (WAN <-> LAN) and does not typically improve speeds for traffic bridged within the same interface (e.g., WLAN to LAN on the same bridge).
(Smart Queue Management) to work alongside offloading. Troubleshoot common issues with flow offload. kmod-nft-offload - [OpenWrt Wiki] package
To understand why kmod-nft-offload is revolutionary, consider standard packet processing:
kmod-nft-offload requires Linux Kernel for basic netdev offload and 5.13+ for significantly improved flow_block support. For production, use Kernel 6.x.