--- title: Our next generation firewall project | daily.dev description: Ngrok describes its redesigned firewall system, Firewall Next-Generation (FWNG), built to address the shift from region-local traffic handling to a globally... canonical: https://daily.dev/posts/our-next-generation-firewall-project-ipfhqbgzw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Our next generation firewall project | daily.dev og:description: Ngrok describes its redesigned firewall system, Firewall Next-Generation (FWNG), built to address the shift from region-local traffic handling to a globally... og:url: https://daily.dev/posts/our-next-generation-firewall-project-ipfhqbgzw og:image: https://api.daily.dev/og/posts/IPfHqBgzw.png og:image:alt: Our next generation firewall project og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Our next generation firewall project **[ngrok Blog](https://daily.dev/sources/ngrok)** · 5 min read · 0 upvotes · 0 comments ## Summary Ngrok describes its redesigned firewall system, Firewall Next-Generation (FWNG), built to address the shift from region-local traffic handling to a globally distributed network. Instead of analyzing telemetry per-region, FWNG aggregates network flow and application telemetry in a central controlplane, generates traffic policies, and distributes them to all regions, allowing coordinated defense against globally distributed attacks like botnets. Telemetry comes from the NetObserv eBPF Agent and internal application metrics; policies are enforced via nftables rules managed by a Go service on ingress nodes. As part of this work, ngrok built and open-sourced the Firewall Toolkit, a Go library on top of Google's nftables library for programmatically managing nftables rules, tables, and sets. Future plans include using eBPF filters for traffic policy enforcement. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Firewall Toolkit library from ngrok used for? Firewall Toolkit is an open-source Go library that builds on Google's nftables Go library to ergonomically and programmatically generate nftables rules, modify tables and sets, and keep them synced with external data sources via the netlink socket, all in pure Go. Ngrok created it to enforce traffic policies on ingress nodes as part of its firewall system. _Developers building nftables automation in Go can find tooling breakdowns like this on daily.dev._ ### How does ngrok detect and block distributed DDoS attacks across multiple regions? Ngrok aggregates network telemetry from all regions into a central controlplane instead of analyzing traffic locally per region. Telemetry from the NetObserv eBPF Agent and application metrics is combined there to generate traffic policies, which are then pushed back to every region so an attack detected in one location triggers protection everywhere, including shared cross-region rate limits. _Teams designing multi-region DDoS defenses can track architecture writeups like this via daily.dev._ ### How does ngrok enforce firewall traffic policies on its ingress nodes? Each ingress node runs a small Go service that polls the controlplane for the current traffic policies and updates nftables rules, tables, and sets accordingly. Policies are generated centrally from aggregated telemetry, and ngrok is also exploring eBPF filters for enforcing policies not easily expressed with nftables or requiring maximum drop performance. _Engineers evaluating nftables versus eBPF for traffic enforcement can follow related infra deep dives on daily.dev._ ## Similar posts on daily.dev - [Network boundary for AI agents using NGINX and OpenTelemetry](https://daily.dev/posts/network-boundary-for-ai-agents-using-nginx-and-opentelemetry-xgu2ub3q7) · CNCF · 3 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#golang](https://daily.dev/tags/golang) [View this post on daily.dev](https://daily.dev/posts/our-next-generation-firewall-project-ipfhqbgzw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Our next generation firewall project","url":"https://daily.dev/posts/our-next-generation-firewall-project-ipfhqbgzw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/our-next-generation-firewall-project-ipfhqbgzw"},"datePublished":"2026-08-23T07:21:32.699Z","dateModified":"2026-08-23T07:29:27.744Z","description":"Ngrok describes its redesigned firewall system, Firewall Next-Generation (FWNG), built to address the shift from region-local traffic handling to a globally...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/02302ec9cdddec1085a88625c311590c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/02302ec9cdddec1085a88625c311590c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/our-next-generation-firewall-project-ipfhqbgzw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux,golang","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Our next generation firewall project"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/our-next-generation-firewall-project-ipfhqbgzw#faq","mainEntity":[{"@type":"Question","name":"What is the Firewall Toolkit library from ngrok used for?","acceptedAnswer":{"@type":"Answer","text":"Firewall Toolkit is an open-source Go library that builds on Google's nftables Go library to ergonomically and programmatically generate nftables rules, modify tables and sets, and keep them synced with external data sources via the netlink socket, all in pure Go. Ngrok created it to enforce traffic policies on ingress nodes as part of its firewall system. Developers building nftables automation in Go can find tooling breakdowns like this on daily.dev."}},{"@type":"Question","name":"How does ngrok detect and block distributed DDoS attacks across multiple regions?","acceptedAnswer":{"@type":"Answer","text":"Ngrok aggregates network telemetry from all regions into a central controlplane instead of analyzing traffic locally per region. Telemetry from the NetObserv eBPF Agent and application metrics is combined there to generate traffic policies, which are then pushed back to every region so an attack detected in one location triggers protection everywhere, including shared cross-region rate limits. Teams designing multi-region DDoS defenses can track architecture writeups like this via daily.dev."}},{"@type":"Question","name":"How does ngrok enforce firewall traffic policies on its ingress nodes?","acceptedAnswer":{"@type":"Answer","text":"Each ingress node runs a small Go service that polls the controlplane for the current traffic policies and updates nftables rules, tables, and sets accordingly. Policies are generated centrally from aggregated telemetry, and ngrok is also exploring eBPF filters for enforcing policies not easily expressed with nftables or requiring maximum drop performance. Engineers evaluating nftables versus eBPF for traffic enforcement can follow related infra deep dives on daily.dev."}}]} ```