netifyd: activate nfqueue mode for improved performance

[Tbaile]

Enable and test netifyd nfqueue mode. The feature is ready but not yet activated after recent package updates. Enabling this mode is expected to improve performance, according to the netifyd producer, potentially by up to 90%.

References:

• https://www.netify.ai/blog/netify-and-netfilter

[Tbaile]

QA:

• Check that netifyd can block out traffic correctly
• Check that netifyd -s shows two interfaces filtering with NFQ
• Add an interface (even a VLAN) add that to the LAN zone, check that netifyd doesn't add another interface (check using the command in the previous test)
• While doing traffic through LAN, check with conntrack -L -o labels if the netify-analyzed is applied, then we know it's passing through NFQ
• Check that the block is being applied correctly through conntracks

[gsanchietti]

Blocked and analyzed connections:

NFQ chains:

root@NethSec:~# nft list ruleset | grep -C 20 dpi
# Warning: table ip6 mangle is managed by iptables-nft, do not touch!
	chain block_chain {
		type filter hook forward priority filter - 10; policy accept;
	}

	chain nfq_input {
		type filter hook input priority filter + 10; policy accept;
		ip saddr 127.0.0.1 ip daddr 127.0.0.1 accept
		ip6 saddr ::1 ip6 daddr ::1 accept
		ct packets > 32 counter packets 508 bytes 48388 accept
		iifname != "eth1" queue flags bypass to 50-53
		iifname "eth1" queue flags bypass to 60-63
	}

	chain nfq_forward {
		type filter hook forward priority filter + 10; policy accept;
		ct packets > 32 counter packets 2049 bytes 3498038 accept
		iifname != "eth1" queue flags bypass to 50-53
		iifname "eth1" queue flags bypass to 60-63
	}

	chain dpi_dummy {
		ct label set "netify-init"
	}

	chain dpi_actions {
		type filter hook prerouting priority filter + 10; policy accept;
		ct label "netify-blocked" counter packets 98 bytes 123197 reject
		ct label "bulk" counter packets 0 bytes 0 ip dscp set cs1 return
		ct label "best_effort" counter packets 0 bytes 0 ip dscp set cs0 return
		ct label "video" counter packets 0 bytes 0 ip dscp set af41 return
		ct label "voice" counter packets 0 bytes 0 ip dscp set cs6 return
	}
}

netifyd config:

root@NethSec:~# netifyd -s
Netify Agent/5.1.25 (openwrt; linux-gnu; x86_64; conntrack; netlink; dns-cache; nfqueue; regex)
✓ agent is running: PID 15609
• agent timestamp: Wed Feb 18 13:32:04 2026
• agent uptime: 0d 00:05:00
✓ agent UUID: Y4-R8-M8-1Z
! site UUID is not set.
  ↪ A new site UUID will be automatically set after this agent has been provisioned.
! API updates: disabled
  ↪ Netify API updates can be enabled from the configuration file:
    /etc/netifyd.conf
! license manager available: no
✓ active flows: 37 / unlimited (0.0%)
• flows purged: 2, in-use: 2
• flows expiring: 0, expired: 4
• minimum flow size: 4672
• CPU cores: 2
✓ CPU utilization (user + system): 0.1%
✓ CPU time (user / system): 0.0s / 0.0s
• memory RSS: 21440 kB, maximum memory RSS: 22340 kB
✓ lan [LAN → NFQ]: online: packets dropped: 0.000%
✓ wan [WAN → NFQ]: online: packets dropped: 0.000%
• apps: 199, app-IP overrides: 0, domains: 3374, networks: 783, soft-dissectors: 26, transforms: 0
✓ DNS hint cache: enabled
• DHC entries: 58, inserts: 72 (19.4%), lookups: 155 (45.8%)
✓ flow hash cache: enabled
• FHC entries: 151, inserts: 151 (0.0%), lookups: 177 (0.0%)
• persistent state path: /etc/netifyd
• volatile state path: /var/run/netifyd
proc-aggregator/1.0.89 (processor)
• aggregator #1
• samples: 0
✓ license status: valid
proc-core/1.0.94 (processor)
proc-nfa/1.1.46 (processor)
✓ license status: valid
• actions: 2, enabled: 2
• targets: 3, enabled: 3
• global exemptions: 0
• flows: 3 / 3, queued: 1
sink-http/1.0.64 (sink)
sink-log/1.0.62 (sink)
sink-socket/1.0.76 (sink)