Is there a possiblity, to restrict a cgroup to a specific network interface? All packets from the cgroup should only be routed via a VPN connection, while other packets use the default route.

With unix users its possible with iptables "-m owner --set-mark" and then routing with "ip rule".

Is it possible to match a cgroup? iptables seems to have no support for this.

up vote 4 down vote accepted

iptables support for -m cgroup has not yet been released, but you can easily build the extension yourself and install it on your system:

git clone git://git.netfilter.org/iptables.git
cd iptables
./autogen.sh
./configure
make -k
sudo cp extensions/libxt_cgroup.so /lib/xtables/
sudo chmod -x /lib/xtables/libxt_cgroup.so
  • Depending on your system, you may also do the same for git.netfilter.org/libnftnl/ (...; make -k; sudo make install) and do a autoreconf -fi before running configure. This is for debian jessie. – relet Nov 12 '15 at 9:41
  • First install pre-requisites sudo apt-get install dh-autoreconf bison flex.Then, I recommend using these build instructions to avoid several build errors. Especially use ./configure --disable-nftables flag and make install. – KrisWebDev Feb 28 '16 at 18:58
  • Works with debian unstable iptables binary. Great! – allo May 4 '16 at 21:56

Use -m cgroup. Example:

iptables -A OUTPUT -m cgroup ! --cgroup 1 -j DROP

From: http://lwn.net/Articles/569678/

  • I guess this is what i searched, seems it was not supported by my kernel in dec 2013. I will check back and mark as accepted when i had time to test it. Where do i get the cgroup id, i.e. for a lxc container? – allo Jun 3 '14 at 20:57
  • I tested it, it does not work on debian jessie. The xt_cgroup module is there, but iptables with -m cgroup does not find the match target and the net_filter mount does not work either. I guess i need to investigate, if some of the apis changed afterwards. Or check if cgroup/net_cls is useful. – allo Jan 24 '15 at 17:24

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.