Systemd now allows loading of custom BPF programs for network traffic filtering that are applied to all sockets created by processes of a given systemd unit.

The motivation for this stems from a feature plan drawn up last year for having systemd install BPF (Berkeley Packet Filter) programs into cgroups. The benefit of this is associating a BPF program for IP filtering with a unit file so systemd can install them once a cgroup is setup.

With the systemd code as of this week, there are now the IPIngressFilterPath and IPEgressFilterPath options so that systemd units can specify a BPF pinned program as an argument. Multiple BPF programs can be specified and apply to all IP packets sent/received under the INET/INET6 sockets created by processes of the unit, in addition to any other filters of the system.

More details in this commit. This change will be in the upcoming systemd 243 release.