Flow Offloading

Flow offloading in Linux is a networking feature that bypasses the CPU-intensive Netfilter stack (firewall processing) for established traffic flows. This approach significantly increases network throughput.

Software Flow Offloading is a fastpath that typically increases bandwidth by 2-3x over firewall filtering each packet, and often relieves fully loaded CPUs improving latency/jitter too. Since SFO is a software feature it is widely supported on all CPUs.

Hardware Flow Offloading requires specialized SoC hardware to bypass QoS traffic controls at high priority, resulting in high throughput and low CPU usage. However, this handles a limited number of concurrent connections, e.g. 64, returning surplus connections to the software offload pool, thus will not significantly help some applications including p2p. It is also incompatible with QoS features such as SQM. This is supported by small number of platforms, primarily MediaTek SoCs.

Abbreviations:

• Software Flow Offloading - SFO
• Hardware Flow Offloading - HFO
• Wireless Ethernet Dispatch - WED
• Packet Processing Engine - PPE

1. Using LuCI web UI go to Network → Firewall.
2. From the dropdown, select Software flow offloading or Hardware flow offloading, depending on your desired features and supported hardware.
3. Hit “Save & Apply”.

Selecting HFO will also enable SFO in the configuration file. As explained in the overview, SFO will still be needed to handle extra concurrent connections.

CLI with UCI:

uci set 'firewall.@defaults[0].flow_offloading=1'
uci set 'firewall.@defaults[0].flow_offloading_hw=1'
uci commit
/etc/init.d/firewall restart

For HFO, enable both options.

CLI: edit /etc/config/firewall and insert the following under the config defaults section:

config defaults
…
  option flow_offloading '1'
  option flow_offloading_hw '1'

For HFO, enable both options.

Then restart the firewall:

/etc/init.d/firewall restart

MediaTek officially has open source Linux support for both HFO and WED on mt76 platforms starting from SoC mt7621. This can be monitored via /sys/kernel/debug/ppe0/entries. The main page about MediaTek chipsets is soc.mediatek.

For hardware offloading of Wi-Fi see the WED page. Note that WED will bypass QoS AQL and stale connections/freezes can occur when changing or roaming (e.g. from 2.4 GHz to 5 GHz) as WED is not available on 2.4 GHz.

Qualcomm SoCs have Network Subsystem (NSS) cores, but they use closed source drivers to function. Because they are not open source there is no official OpenWrt that support for NSS offloading. However there are several community custom builds that add support (e.g. ip806x and ipq807x) that are on the forums such as with wifi 6 devices here: https://forum.openwrt.org/t/qualcommax-nss-build/148529.

• The Linux kernel Netfilter's flowtable infrastructure documentation includes information for Software offload and Hardware offload. This software is in development and features may expand, so confirm the doc page is set to the same version as your kernel.
• Flow offloading is not directly related to network adapter offload functions controlled by ethtool -k/-K.
• Flow offloading applies to forwarded connections, including those to containers like LXC or podman, but not locally running web-server.