Loxilb

Abstract

1. Introduction

loxilb is an open source cloud-native load-balancer based on GoLang/eBPF with the goal of achieving cross-compatibility across a wide range of on-prem, public-cloud or hybrid K8s environments. loxilb is being developed to support the adoption of cloud-native tech in telco, mobility, and edge computing.

Service type load-balancer is usually provided by public cloud-provider(s) as a managed entity. But for on-prem and self-managed clusters, there are only a few good options available. Even for provider-managed K8s like EKS, there are many who would want to bring their own LB to clusters running anywhere. Additionally, Telco 5G and edge services introduce unique challenges due to the variety of exotic protocols involved, including GTP, SCTP, SRv6, SEPP, and DTLS, making seamless integration particularly challenging. loxilb provides service type load-balancer as its main use-case. loxilb can be run in-cluster or ext-to-cluster as per user need.

For deploying telco-cloud with cloud-native functions, loxilb can be used as an enhanced SCP(service communication proxy). SCP is a communication proxy defined by 3GPP and aimed at telco micro-services running in cloud-native environment. Read more in this blog

2. Objective

eBPF based cloud-native load-balancer for Kubernetes|Edge|Telco|IoT|XaaS.

This project demonstrates how Go, Kubernetes can be applied to a real-world Cybersecurity & Ethical Hacking problem.

3. Key Features / Modules

• L4/NAT stateful loadbalancer
• NAT44, NAT66, NAT64 with One-ARM, FullNAT, DSR etc
• Support for TCP, UDP, SCTP (w/ multi-homing), QUIC, FTP, TFTP etc
• High-availability support with BFD detection for hitless/maglev/cgnat clustering
• Extensive and scalable end-point liveness probes for cloud-native environments
• Stateful firewalling and IPSEC/Wireguard support
• Optimized implementation for features like Conntrack, QoS, etc
• Full compatibility for ipvs (ipvs policies can be auto inherited)
• Policy oriented L7 proxy support - HTTP1.0, 1.1, 2.0, 3.0

4. Technology Stack

• GoLang based control plane components
• A scalable/efficient eBPF based data-path implementation
• Integrated goBGP based routing stack
• A kubernetes operator kube-loxilb written in Go
• A kubernetes ingress implementation

5. System Requirements

General requirements for this technology stack — check the README for exact versions.

• Go 1.20 or later
• Git (to clone the repository)

6. Installation & Setup

git clone https://github.com/loxilb-io/loxilb.git
cd loxilb

Full setup instructions are in the project README.

7. Future Enhancements

Suggested extensions you can add to make this your own project.

• Add logging and alert notifications (email / Telegram)
• Write a threat model document for the tool
• Package it with Docker for safe lab testing

8. Viva / Review Questions

Common questions examiners ask for projects in this domain.

1. Which threat or attack does this project defend against?
2. What detection or protection technique is used and what are its limits?
3. How are false positives and false negatives handled?
4. Which cryptographic algorithms or security standards are involved?
5. What legal and ethical rules apply when testing a tool like this?

9. Source Code & License

This project is developed by loxilb-io and published on GitHub under the Apache License 2.0. Please follow the license terms and credit the original author when you use or modify this code.