Home / server / Questions / 560179
Accepted
allo
Asked: 2013-12-10 10:14:05 +0800 CST

route traffic from a cgroup via a specific network interface

  • 772

Is there a possiblity, to restrict a cgroup to a specific network interface? All packets from the cgroup should only be routed via a VPN connection, while other packets use the default route.

With unix users its possible with iptables "-m owner --set-mark" and then routing with "ip rule".

Is it possible to match a cgroup? iptables seems to have no support for this.

iptables

2 Answers

  1. Best Answer

    iptables support for -m cgroup has not yet been released, but you can easily build the extension yourself and install it on your system:

    git clone git://git.netfilter.org/iptables.git
cd iptables
./autogen.sh
./configure
make -k
sudo cp extensions/libxt_cgroup.so /lib/xtables/
sudo chmod -x /lib/xtables/libxt_cgroup.so
    • 4

  2. Use -m cgroup. Example:

    iptables -A OUTPUT -m cgroup ! --cgroup 1 -j DROP

    From: http://lwn.net/Articles/569678/

    • 1