🛡️ NGFW — Next-Generation Firewall
A modern firewall is no longer a simple packet filter — it inspects, decrypts, translates, and forwards traffic at line rate, all at once. This track takes you from what a firewall is all the way to how a real one is engineered, using a concrete design built on the open-source VPP data plane, with Snort for intrusion prevention and StrongSwan for VPN. Across eight self-contained modules you’ll follow a single packet from wire to tunnel, meet every moving part, and finish ready to read the code and make your first change — no prior firewall or data-plane experience assumed. The one idea that ties it all together: a fast C data plane, proven engines beside it, and thin, well-defined bridges connecting everything.
This section is the capstone of the Data Plane track: it assumes you have met (or are learning) the DPDK and VPP building blocks, and shows how they combine into a complete security appliance.
Note on scope. These notes describe a generic NGFW architecture and the open-source technologies it is built from (VPP, DPDK, Snort, StrongSwan). Addresses, product names, and vendor-specific details are illustrative only.
Learning Path
| # | Module | What you’ll learn |
|---|---|---|
| 01 | NGFW from First Principles | What a firewall is, the four generations, what makes one “next-gen”, and the three-plane model. |
| 02 | Architecture Overview | The three planes of a real NGFW platform, the component inventory, the inter-process channels, and startup order. |
| 03 | The VPP Data Plane | The packet graph, vector processing, node anatomy, feature arcs, and how nodes pass decisions via buffer metadata. |
| 04 | Packet Walkthrough | One connection end to end: classify → decide → IPS → NAT → IPsec → egress, the six paths, drops, and the return trip. |
| 05 | IPS Integration (Snort + DAQ) | Feeding a separate Snort process at line rate: shared-memory queue pairs, zero-copy descriptors, the handshake, and the verdict round-trip. |
| 06 | IPsec / VPN | The control/data split: StrongSwan IKE negotiates keys, a bridge installs SAs into VPP, and the data plane encrypts at line rate. |
| 07 | Management Plane | Turning per-packet counters into dashboards: JNI, the stats segment vs the binary API, per-feature reporters, and alarms. |
| 08 | Contributor’s Guide | Repo layout, the build systems, running & config, the add-a-node recipe, the debugging toolkit, and the gotchas. |