4

Is there a possiblity, to restrict a cgroup to a specific network interface? All packets from the cgroup should only be routed via a VPN connection, while other packets use the default route.

With unix users its possible with iptables "-m owner --set-mark" and then routing with "ip rule".

Is it possible to match a cgroup? iptables seems to have no support for this.

Improve this question
1

2 Answers 2

Reset to default
4

iptables support for -m cgroup has not yet been released, but you can easily build the extension yourself and install it on your system:

git clone git://git.netfilter.org/iptables.git
cd iptables
./autogen.sh
./configure
make -k
sudo cp extensions/libxt_cgroup.so /lib/xtables/
sudo chmod -x /lib/xtables/libxt_cgroup.so
Improve this answer
4
  • Depending on your system, you may also do the same for git.netfilter.org/libnftnl/ (...; make -k; sudo make install) and do a autoreconf -fi before running configure. This is for debian jessie.
    – relet
    Nov 12, 2015 at 9:41
  • First install pre-requisites sudo apt-get install dh-autoreconf bison flex.Then, I recommend using these build instructions to avoid several build errors. Especially use ./configure --disable-nftables flag and make install.
    – KrisWebDev
    Feb 28, 2016 at 18:58
  • Works with debian unstable iptables binary. Great!
    – allo
    May 4, 2016 at 21:56
  • "iptables support for -m cgroup has not yet been released" -- how did you not this? Not doubting, but would like to know how you were able to find this out.
    – Raleigh L.
    Feb 1 at 19:33
1

Use -m cgroup. Example:

iptables -A OUTPUT -m cgroup ! --cgroup 1 -j DROP

From: http://lwn.net/Articles/569678/

Improve this answer
2
  • I guess this is what i searched, seems it was not supported by my kernel in dec 2013. I will check back and mark as accepted when i had time to test it. Where do i get the cgroup id, i.e. for a lxc container?
    – allo
    Jun 3, 2014 at 20:57
  • I tested it, it does not work on debian jessie. The xt_cgroup module is there, but iptables with -m cgroup does not find the match target and the net_filter mount does not work either. I guess i need to investigate, if some of the apis changed afterwards. Or check if cgroup/net_cls is useful.
    – allo
    Jan 24, 2015 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.