Kmod-nft-offload

The package kmod-nft-offload is a kernel module for OpenWrt that enables Hardware Flow Offloading for the nftables firewall. It allows the network hardware (NIC/Switch) to handle packet routing and NAT tasks directly, significantly reducing CPU load and increasing throughput. Key Details

Observability and debugging

• Use nft and libnftnl diagnostics to review rule sets and counters.
• Check kernel logs (dmesg) and module-specific debug via sysfs or debugfs if available.
• Use ethtool or vendor CLI to view NIC flow tables and counters.
• Capture packets at ingress/egress to verify hardware behavior and fallbacks.
• Be prepared to compare hardware behavior across firmware/driver versions.

Routers that might top out at 400-500 Mbps in software-only mode can often reach full Gigabit speeds (1000 Mbps) with hardware offloading enabled. Reduced CPU Load: kmod-nft-offload

The Offload: All following packets in that conversation bypassed the King entirely. They zipped through the kingdom at lightning speed, handled by the strategist’s specialized shortcuts. The Result The package kmod-nft-offload is a kernel module for

Quick checklist for evaluation

• Does your NIC/driver advertise nft/flow offload support? (Yes → proceed)
• Are your hot flows simple L3/L4 patterns? (Yes → good candidate)
• Can you accept vendor-specific behavior and debugging complexity? (Yes → test)
• Do you have monitoring to observe offload effectiveness? (Yes → deploy)

• kmod : Kernel Module. This signifies that the component is not permanently built into the kernel but loaded dynamically.
• nft : nftables. The modern successor to iptables for packet classification.
• offload : The act of moving specific processing tasks from the main CPU to a dedicated hardware processor (typically on the NIC).