News, insights, and engineering stories from the nfSensei project.
A visual history of the nfSensei logo: from the sword-and-peace-sign mascot inherited from the project's pfSense-era placeholder, through a roughly 300-concept brainstorm that wandered into network diagrams and unrelated mascots, converging on a distilled sensei face run through a systematic headwear-and-expression matrix — and ending with the two directions still on the table today, undecided.
See the full history → Design BrandAn engineering report on PFL: a from-scratch reimplementation of OpenBSD's pf — its configuration language and its stateful packet-processing semantics — as a Rust program compiled to eBPF and attached to the Linux XDP hook, before the kernel allocates a socket buffer.
It covers the architecture (a tail-called pipeline of XDP programs, an 80-byte inter-stage scratchpad, an established-flow fast path), how the kernel verifier's 512-byte stack and bounded-execution rules shape the design, the extent of pf parity achieved (NAT/NAT64, anchors, policy routing, dual-stack) and what is architecturally precluded, in-XDP SYN-cookie DoS resistance, and an evaluation that quotes only a controlled VM latency result — with an explicit account of why that is not yet a wire-speed claim.
nfSensei is a next-generation firewall and network operating system. Built from scratch in Rust with a React web interface, it delivers an API-first architecture where every operation — CLI, web UI, and on-device AI — flows through the same clean interface.
Key highlights: