Need help with npf?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

152 Stars 30 Forks Other 229 Commits 7 Opened issues


NPF: packet filter with stateful inspection, NAT, IP sets, etc.

Services available


Need anything else?

Contributors list

No Data

NPF: stateful packet filter supporting NAT, IP sets, etc

Build Status

NPF is a layer 3 packet filter, supporting stateful packet inspection, IPv6, NAT, IP sets, extensions and many more. It uses BPF as its core engine and it was designed with a focus on high performance, scalability, multi-threading and modularity. NPF was written from scratch in 2009. It is written in C99 and distributed under the 2-clause BSD license.

NPF is provided as a userspace library to be used in a bespoke application to process packets. It can run on Linux, typically, in combination with such frameworks like Data Plane Development Kit (DPDK) or netmap.


NPF offers the traditional set of features provided by packet filters. Some key features are: - Stateful inspection (connection tracking). - Including the full TCP state tracking. - Network address translation (NAT): - Static (stateless) and dynamic (stateful) translation. - NAPT and other forms of port translation (e.g. port forwarding). - Inbound and outbound NAT as well as bi-directional NAT. - Network-to-network translation, including NETMAP and NPTv6. - Carrier-grade NAT (CG-NAT) capability: known to serve over a million connections. - Tables for efficient IP sets, including the longest prefix match support. - Application Level Gateways (e.g. to support traceroute). - NPF uses BPF with just-in-time (JIT) compilation. - Rule procedures and a framework for NPF extensions (plugins). - Extensions include: traffic normalization and packet logging. - Data Plane Development Kit integration.

For a full set of features and their description, see the NPF documentation and other manual pages.


You can try NPF-Router as a demo NPF+DPDK application, running a virtual test network with Docker containers.


See on Github Pages. Source in the docs directory.


  • libnv:
    git clone
  • thmap:
    git clone
  • libqsbr:
    git clone
  • liblpm:
    git clone
  • bpfjit:
    git clone
  • libcdb:
    git clone

Each repository provides the build files for RPM (

cd pkg && make rpm
) and DEB (
cd pkg && make deb
) packages. You can also check the Travis file for an example of how to build everything.

Source code structure

app/                - NPF-Router demo application (NPF + DPDK + Docker)
docs/               - documentation source
src/                - root source code directory
    kern/           - the kernel component (npfkern library)
    libnpf/         - library to manage the NPF configuration
    npfctl/         - command line user interface to control NPF
    npftest/        - unit tests and a tool to debug NPF
pkg/                - packaging files (RPM and DEB)
misc/               - auxiliary helper scripts


To build the libnpf library (link using the

flags) packages: * RPM (tested on RHEL/CentOS 7):
cd pkg && make rpm
* DEB (tested on Debian 9):
cd pkg && make deb

Who is using NPF?

Outscale innofield AG NetBSD TheRouter

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.