5

Is there a possiblity, to restrict a cgroup to a specific network interface? All packets from the cgroup should only be routed via a VPN connection, while other packets use the default route.

With unix users its possible with iptables "-m owner --set-mark" and then routing with "ip rule".

Is it possible to match a cgroup? iptables seems to have no support for this.

Improve this question
1

2 Answers 2

Reset to default
5

iptables support for -m cgroup has not yet been released, but you can easily build the extension yourself and install it on your system:

git clone git://git.netfilter.org/iptables.git
cd iptables
./autogen.sh
./configure
make -k
sudo cp extensions/libxt_cgroup.so /lib/xtables/
sudo chmod -x /lib/xtables/libxt_cgroup.so
Improve this answer
4
  • Depending on your system, you may also do the same for git.netfilter.org/libnftnl/ (...; make -k; sudo make install) and do a autoreconf -fi before running configure. This is for debian jessie.
    – relet
    Commented Nov 12, 2015 at 9:41
  • First install pre-requisites sudo apt-get install dh-autoreconf bison flex.Then, I recommend using these build instructions to avoid several build errors. Especially use ./configure --disable-nftables flag and make install.
    – KrisWebDev
    Commented Feb 28, 2016 at 18:58
  • Works with debian unstable iptables binary. Great!
    – allo
    Commented May 4, 2016 at 21:56
  • "iptables support for -m cgroup has not yet been released" -- how did you not this? Not doubting, but would like to know how you were able to find this out.
    – Raleigh L.
    Commented Feb 1, 2023 at 19:33
2

Use -m cgroup. Example:

iptables -A OUTPUT -m cgroup ! --cgroup 1 -j DROP

From: http://lwn.net/Articles/569678/

Improve this answer
2
  • I guess this is what i searched, seems it was not supported by my kernel in dec 2013. I will check back and mark as accepted when i had time to test it. Where do i get the cgroup id, i.e. for a lxc container?
    – allo
    Commented Jun 3, 2014 at 20:57
  • I tested it, it does not work on debian jessie. The xt_cgroup module is there, but iptables with -m cgroup does not find the match target and the net_filter mount does not work either. I guess i need to investigate, if some of the apis changed afterwards. Or check if cgroup/net_cls is useful.
    – allo
    Commented Jan 24, 2015 at 17:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .