I have left this website quiet again for longer than I wanted, so this is a small update on what I am working on now.
The main thing is ILShield, a DoS and DDoS filtering appliance. I am building it around fast packet decisions, but I am trying to keep the boring parts in mind too: configuration, logs, counters, safe changes and how it behaves when traffic is not as clean as a test case.
Right now the design uses XDP on ingress, so unwanted packets can be handled early in the Linux receive path. I am also working with eBPF on egress, because outbound policy is just as important once the appliance becomes more than a lab setup.
It is going well, but there is still work to do. Rule management, telemetry, false positives and update safety all need proper attention before I would be comfortable calling it finished.
I am also seriously thinking about opening my own datacenter in Romania. That is still a large step, and it needs planning, money and a lot of patience, but it matches the kind of work I want to do long term: running the network, understanding the hardware and having direct control over the platform.