{"id":29194229,"url":"https://github.com/upioti/minecraft-bedrock-xdp-ebpf","last_synced_at":"2026-05-17T11:32:30.061Z","repository":{"id":302197105,"uuid":"1011587460","full_name":"Upioti/minecraft-bedrock-xdp-ebpf","owner":"Upioti","description":"First and only publicly avaliable Raknet/Minecraft Bedrock XDP filter, Protects your server by dropping all traffic that isnt valid Layer7 Raknet/MC Bedrock Protocol","archived":false,"fork":false,"pushed_at":"2025-08-03T15:41:44.000Z","size":266,"stargazers_count":8,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-08-03T17:33:10.997Z","etag":null,"topics":["antiddos","appfilter","bedrock","bpf","ddos","ebpf","filter","firewall","layer7","linux-networking","minecraft","packet","protection","raknet","udp","xdp"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Upioti.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-01T03:53:38.000Z","updated_at":"2025-08-03T15:41:47.000Z","dependencies_parsed_at":null,"dependency_job_id":"9aa63827-4087-4193-a431-c5dc3f3655e0","html_url":"https://github.com/Upioti/minecraft-bedrock-xdp-ebpf","commit_stats":null,"previous_names":["upioti/minecraft-bedrock-xdp-ebpf"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/Upioti/minecraft-bedrock-xdp-ebpf","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Upioti%2Fminecraft-bedrock-xdp-ebpf","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Upioti%2Fminecraft-bedrock-xdp-ebpf/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Upioti%2Fminecraft-bedrock-xdp-ebpf/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Upioti%2Fminecraft-bedrock-xdp-ebpf/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Upioti","download_url":"https://codeload.github.com/Upioti/minecraft-bedrock-xdp-ebpf/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Upioti%2Fminecraft-bedrock-xdp-ebpf/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":270859063,"owners_count":24658148,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-17T02:00:09.016Z","response_time":129,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["antiddos","appfilter","bedrock","bpf","ddos","ebpf","filter","firewall","layer7","linux-networking","minecraft","packet","protection","raknet","udp","xdp"],"created_at":"2025-07-02T04:01:00.630Z","updated_at":"2026-05-17T11:32:30.021Z","avatar_url":"https://github.com/Upioti.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Bedrock-XDP\r\n\r\nA high-performance **eBPF/XDP Stateless DDoS-mitigation Appfilter** written in Go and C.  \r\nIt is laser-focused on protecting Raknet-based game services – especially **Minecraft: Bedrock Edition** (RakNet) – but can be deployed in front of any raknet service that needs lightning-fast packet filtering at the Linux kernel level.\r\n\r\n\u003e **Powered by XDP:** packets are inspected *before* they hit the OS – typical mitigation latency is \u003c 1 µs and filtering throughput is measured in **tens of millions of packets per second** on common server hardware.\r\n\r\n\u003e *Raknet validation is currently stateless... this is open source, If you need a stateful filter contact me.*\r\n\r\nEffectively drops all non-raknet traffic targetting protected ports, features ratelimit and global blocklist to enhance DDoS mitigation capabilities\r\n\r\n\r\n*Please follow the LICENCE accordingly, if you are interested in running this in a comercial enviroment contact me.*\r\n\r\n*Also check out [Papyrus](https://papyrus.vip/)*\r\n\r\n## Pull Requests are welcome!\r\n\r\n---\r\n\r\n## Features\r\n\r\n| Category | What it does |\r\n|----------|--------------|\r\n| Traffic classification | • Early drop of non-IPv4 traffic  |\r\n| Dedicated counters for **UDP** vs **OTHER** protocols | • Distinguish traffic amount per protocol/destination |\r\n| Configurable Blocklist | • Drops traffic from identified malicious ips (toggeable) |\r\n| Per-service protected bind list (IP/Port or wildcard) | • Enable Application filter on specific destinations |\r\n| Rate limiting | • Per-IP PPS throttle with optional automatic block  |\r\n| Reflection / amplification filters | • AMP source-port detection via known-ports map |\r\n| Application Filtering | • **RakNet** packet-ID and RakNet magic validation (verifier-safe) |\r\n| Observability | • Console dashboard |  \r\n| Prometheus metrics | • Pretty graphs|\r\n\r\n\r\n---\r\n\r\n## Architecture\r\n\r\n```\r\n┌────────────────────────────┐      userspace (Go)\r\n│  analytics/     mitigation/│◀──────────────┐      Prometheus\r\n└────────┬───────────────────┘                │\r\n         │ EBPF maps                          │ scrape / push\r\n         ▼                                    │\r\n┌─────────────────────────────────────────────┐\r\n│                 xdp/xdp.c                   │  \u003c 1 µs\r\n│ (XDP program – able to run in NIC driver)   │\r\n└─────────────────────────────────────────────┘\r\n```\r\n\r\n* **Kernel space (`xdp/`)** – ultra-small C program compiled with libbpf.  \r\n  • Maintains consolidated pass/drop counters.  \r\n  • Consults mitigation maps (`protected_map`, `blocklist_map`, …).  \r\n  • Drops or passes packets instantly.\r\n\r\n* **User space (`mitigation/`, `analytics/`)** – written in Go using [`cilium/ebpf`](https://github.com/cilium/ebpf).  \r\n  • Loads the XDP object, populates/refreshes maps, flushes blocklists.  \r\n  • Exposes live stats through a colourful console UI and/or Prometheus.\r\n\r\n---\r\n\r\n## Requirements\r\n\r\n* Linux 5.10+ (any distro with eBPF and XDP generic/native support).  \r\n* `clang`/`llvm` + `bpftool` to build the kernel object.  \r\n* Go 1.20+ for the user-space components.  \r\n* Root privileges (needed to attach the program and update maps).\r\n\r\n---\r\n\r\n## Build \u0026 Run\r\n\r\n```bash\r\n# Clone repository\r\n$ git clone https://github.com/Upioti/minecraft-bedrock-xdp-ebpf.git \u0026\u0026 cd minecraft-bedrock-xdp-ebpf\r\n\r\n# Build Go binaries (kernel object is embedded, so no Makefile magic needed)\r\n$ go build -o bedrock-xdp ./main\r\n\r\n$ clang -g -I/libbpf/src -O2 -target bpf -c ./xdp/xdp.c -o ./xdp/xdp.o\r\n\r\n# Edit config.yaml to fit your interface, binds and limits\r\n$ sudo ./bedrock-xdp\r\n```\r\n(Or download from releases tab, compiled on ubuntu)\r\n\r\n### Configuration (`config.yaml`)\r\n\r\n```yaml\r\nnetwork:\r\n  interface: \"bond0\" # Interface the Bedrock Filter will run on\r\n  xdpmode: \"AUTO\" # AUTO, DRV, SKB (GENERIC), NIC\r\n  \r\n\r\nprometheus:  #Configuration for prometheus stats\r\n  enabled: true\r\n  bind: \"0.0.0.0:9090\"\r\n  pop: \"Gotham, City\" # Point-of-presence label used in Prometheus metrics\r\n\r\nprotection:\r\n  ratelimit: true # Enable rate limiting\r\n  limit: 300 # Rate limit per ip in packets per second\r\n  block: true # Will add IPs to the blocklist if they surpass the rate limit\r\n  binds:  # Destinations that should go through the Bedrock Filter\r\n    - \"1.1.1.1:19132\"\r\n    - \"2.2.2.2:19132\"\r\n    - \"0.0.0.0:19132\" # To filter EVERYTHING on a specific port use 0.0.0.0\r\n\r\n#The blocklist feature will drop all further traffic from an IP after it has sent an invalid raknet packet\r\nblocklist:\r\n  enabled: true # Enable blocklist\r\n  blocktime: 60 # How many seconds to wait before cleaning the blocklist\r\n  global: true # Drop all traffic from blocked IPs regardless of Protocol or Destination\r\n\r\nstats:\r\n  interval: 5 # Seconds – window over which PPS/BPS stats are aggregated\r\n```\r\n\r\n---\r\n\r\n## Metrics\r\n\r\n![Prometheus Metrics](assets/prometheus.png)\r\n\r\nWhen Prometheus is enabled the exporter provides these series:\r\n\r\n* `passed_pps{pop,protocol}` - Passed packets per second by protocol\r\n* `passed_bps{pop,protocol}` - Passed bits per second by protocol\r\n* `dropped_pps{pop,protocol}` - Dropped packets per second by protocol\r\n* `dropped_bps{pop,protocol}` - Dropped bits per second by protocol\r\n* `blocked_ips_total{pop}` - Number of source IPs currently in blocklist map\r\n\r\nCombine them with counters from other nodes for a cluster-wide view.\r\n\r\n\r\n---\r\n\r\n\r\n\r\n## Credits\r\n\r\n* Built with ❤️ using [**cilium/ebpf**](https://github.com/cilium/ebpf) and the Linux eBPF toolchain.\r\n* Special thanks to [@Outfluencer](https://github.com/Outfluencer) for the inspiration to release a bedrock filter, check out his [MC Java Appfilter](https://github.com/Outfluencer/Minecraft-XDP-eBPF/)\r\n* LLMs For making development much faster (Did this in like 3 hours, please dont complain if some modules were edited by AI)\r\n\r\n\r\n\r\n### Check out Papyrus \u0026 Arvoris 💙\r\n\r\nNeed rock-solid anycast and **Active** Layer7 Mitigation for your network?  \r\nCheck out **[Papyrus.VIP](https://papyrus.vip/)** – Premium DDoS Protection solutions.  \r\nFor a budget-friendly alternative for your small server, visit **[Arvoris](https://arvoris.net/)**.\r\n\r\n---\r\n\r\n## License\r\n\r\n\r\nSee `LICENSE` file for details. \r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fupioti%2Fminecraft-bedrock-xdp-ebpf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fupioti%2Fminecraft-bedrock-xdp-ebpf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fupioti%2Fminecraft-bedrock-xdp-ebpf/lists"}