Forwarding packets at scale - Building a Cloud Data Plane using eBPF/XDP#

Maximilian Wilhelm, Marcus Wichelmann (Hetzner)

• Why: Hetzner replaced an Open vSwitch-based data plane connecting hundreds of thousands of cloud servers with a purpose-built eBPF/XDP stack (hcnet). This is a production, at-scale validation of eBPF as a cloud data plane — exactly the kind of datapath-internals work the PM cares about.
• What: A three-year journey resulting in hcnet: an XDP-based network stack handling public/private cloud networking (VXLAN encapsulation), stateful firewalls, DHCP, and packet-capture tooling, with a Go control plane. Running in Hetzner's internal cloud for two years; public beta pending full feature parity with the OVS stack.
• How: Each cloud node runs XDP programs at the NIC that implement ARP/NDP/ICMP responding, port security, stateful firewalls (rulesets validated, normalized, compiled into eBPF instruction sequences, then loaded as templated programs), VXLAN VTEPs, and a DHCP/metadata server. The stack self-heals where possible, exposes per-interface/per-member metrics, and provides diagnostic tooling (hcnet describe ifaces, hcnet dataplane stats, conntrack map inspection, XDP-redirect-based hcnet capture writing pcaps with BPF filters). Current pain points: NIC driver maturity (e.g., an ixgbe XDP-redirect bonding bug reported upstream) and lack of offloading support; kernel patches (tun XDP metadata) being upstreamed.
• Where applicable: Cloud/hosting providers and large Linux-based fabrics. Hetzner-scale and -specific in deployment, but the architectural patterns (XDP gateway per node, firewall-rule-to-eBPF compilation pipeline, Go control plane) are broadly adoptable for anyone with in-house eBPF expertise.