Is there a possiblity, to restrict a cgroup to a specific network interface? All packets from the cgroup should only be routed via a VPN connection, while other packets use the default route.

With unix users its possible with iptables "-m owner --set-mark" and then routing with "ip rule".

Is it possible to match a cgroup? iptables seems to have no support for this.


2 Answers 2


iptables support for -m cgroup has not yet been released, but you can easily build the extension yourself and install it on your system:

git clone git://git.netfilter.org/iptables.git
cd iptables
make -k
sudo cp extensions/libxt_cgroup.so /lib/xtables/
sudo chmod -x /lib/xtables/libxt_cgroup.so
  • Depending on your system, you may also do the same for git.netfilter.org/libnftnl/ (...; make -k; sudo make install) and do a autoreconf -fi before running configure. This is for debian jessie.
    – relet
    Nov 12, 2015 at 9:41
  • First install pre-requisites sudo apt-get install dh-autoreconf bison flex.Then, I recommend using these build instructions to avoid several build errors. Especially use ./configure --disable-nftables flag and make install.
    – KrisWebDev
    Feb 28, 2016 at 18:58
  • Works with debian unstable iptables binary. Great!
    – allo
    May 4, 2016 at 21:56
  • "iptables support for -m cgroup has not yet been released" -- how did you not this? Not doubting, but would like to know how you were able to find this out.
    – Raleigh L.
    Feb 1, 2023 at 19:33

Use -m cgroup. Example:

iptables -A OUTPUT -m cgroup ! --cgroup 1 -j DROP

From: http://lwn.net/Articles/569678/

  • I guess this is what i searched, seems it was not supported by my kernel in dec 2013. I will check back and mark as accepted when i had time to test it. Where do i get the cgroup id, i.e. for a lxc container?
    – allo
    Jun 3, 2014 at 20:57
  • I tested it, it does not work on debian jessie. The xt_cgroup module is there, but iptables with -m cgroup does not find the match target and the net_filter mount does not work either. I guess i need to investigate, if some of the apis changed afterwards. Or check if cgroup/net_cls is useful.
    – allo
    Jan 24, 2015 at 17:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .