Scripting Netfilter with Lua: A Cooperative Kernel-Userspace Pipeline#

Lourival Vieira Neto, Md. Shehar Yaar Tausif, Firas Shaari, Marcel S. A. de Moura, Arif Alam

Why: An L7 filtering design that deliberately does not intercept TLS — no CA on every client, no per-connection termination — and still ships in production on Wi-Fi access-point hardware. That trade-off is worth understanding even if you never write kernel Lua.

What: A kernel/userspace pipeline that classifies flows from DNS queries, HTTP requests and TLS handshake metadata instead of decrypting them, built on the Lunatik kernel-scripting framework.

How: A userspace Lua agent generates an nftables bridge ruleset that dispatches each new flow to a Netfilter hook for classification; nftables then caches the verdict in a set so subsequent packets bypass Lua entirely. Three new bindings: luanetfilter (Netfilter hooks), luaskb (socket-buffer access and reply synthesis), luanftables (libnftables wrapper). Sustains 1.4 Gbps at parity with a plain Linux bridge on a Wi-Fi 6 AP under mixed Ethernet/Wi-Fi HTTPS load; shipping as the in-kernel engine of a commercial secure wireless gateway on OpenWiFi APs. (From abstract only.)

Where applicable: Constrained gateway hardware that can't sustain DPI-by-interception; the classify-once-then-cache-the-verdict structure generalizes well beyond Lua.