- PFL is an experimental project aiming to translate pf's firewall language and stateful semantics to Linux's XDP (eXpress Data Path) for efficient packet processing.
- Built on FreeBSD's pfSense legacy, PFL uses Rust for the control plane (pfld) and eBPF dataplane, leveraging XDP's driver-level execution for high packet rates.
- Key architectural features include a tail-call graph pipeline to comply with eBPF verifier constraints, LRU hash maps for connection state, and per-CPU counters.
- PFL achieves significant pf feature parity including filtering, NAT (v4/v6), NAT64, normalization, policy routing, and DoS resistance with SYN cookies.