Linux outbound traffic filtering with: cgroups + tc + iptables Post: 302966558

8 More Discussions You Might Find Interesting

1. IP Networking

measuring traffic with iptables

i have a wireless network that is connected to internet over nat.there is ap that is connected to another ap in bridge mode, on ap is used for clients, and the other is connected to the machine that is doing masquerading. so i want to measure traffic of my clients and i thought about doing it with...

2. Red Hat

How to check the outbound packets in Linux

I have a linux redhat box , our security department in my company informed me that my server's IP sends So many traffic in my network , This box I am using it as FTP server to store the other servers logs . My question briefly is how to check my outbound packets which are going from my PC to the...

3. IP Networking

Iptables/TC: how to make masqueraded traffic go through an openVPN tun0?

Hi all! We have a setup of three computers; Machine A (eth0) -> Machine B (eth0, hso0, tun0) -> Machine C (eth0, tun0) hso0 is the packet interface of a 3G modem, it behaves like a normal network interface. Machine B and C are connected in a VPN using openVPN (TCP). Machine A is a...

4. Shell Programming and Scripting

Block incoming traffic FTP from internet using iptables

Hi everybody. I have the next scenary: eth0: WAN eth1: DMZ eth2: LAN I need to block all incoming trafic from the internet through my network LAN using iptables. I have squid but i need to do this using ipatbles. I have been listening about iptables -A FORDAWARD but I am stuck right...

5. Linux

Linux dhcp client boot process with packets traffic

Hi Everybody, I would like to know the entire network packets exchange, sequence between a linux dhcp client workstation & dhcp server as client comes up starting from OS booting stage as network service starts to the time client gets dhcp IP address. This would be in a typical LAN ...

6. IP Networking

Traffic shaping with iptables

hello, I have a postfix & a local dns running on a single server. this server is connected to internet via a low bandwidth line(with fixed ip). we also have another high speed adsl (dynamic ip). i want to divert all dns request from the local dns & postfix from the server to the adsl...

7. IP Networking

Dividing traffic with u32 iptables filter

I would like to divide traffic between two squid servers. I have been thinking about using iptables u32 filter, to check last bit of ip address which is comming to gateway. Then I would like to direct even IP adresses to one squid host, and odd to the other. Is it reasonable ? Thank you for...

8. IP Networking

Upload problem with traffic shaping though a Linux router.

So I want to limit the download and upload speed of a specific ip adress in a local network. To do this I are using a bach script running in a linux OS (Ubuntu 11.04). The issue here is that the upload shaper does not work. I have tried an alternate solution aswell though that does not work as...

LEARN ABOUT POSIX

tc-cgroup

Cgroup classifier in tc(8)					       Linux						Cgroup classifier in tc(8)

NAME

       cgroup - control group based traffic control filter

SYNOPSIS

       tc filter ... cgroup [ match EMATCH_TREE ] [ action ACTION_SPEC ]

DESCRIPTION

       This  filter  serves as a hint to tc that the assigned class ID of the net_cls control group the process the packet originates from belongs
       to should be used for classification. Obviously, it is useful for locally generated packets only.

OPTIONS

       action ACTION_SPEC
	      Apply an action from the generic actions framework on matching packets.

       match EMATCH_TREE
	      Match packets using the extended match infrastructure. See tc-ematch(8)  for  a  detailed  description  of  the  allowed	syntax	in
	      EMATCH_TREE.

EXAMPLES

       In order to use this filter, a net_cls control group has to be created first and class as well as process ID(s) assigned to it. The follow-
       ing creates a net_cls cgroup named "foobar":

	      modprobe cls_cgroup
	      mkdir /sys/fs/cgroup/net_cls
	      mount -t cgroup -onet_cls net_cls /sys/fs/cgroup/net_cls
	      mkdir /sys/fs/cgroup/net_cls/foobar

       To assign a class ID to the created cgroup, a file named net_cls.classid has to be created which contains the class ID to be assigned as  a
       hexadecimal,  64bit  wide  number.  The upper 32bits are reserved for the major handle, the remaining hold the minor. So a class ID of e.g.
       ff:be has to be written like so: 0xff00be (leading zeroes may be omitted). To continue the above example, the following	assigns  class	ID
       1:2 to foobar cgroup:

	      echo 0x10002 > /sys/fs/cgroup/net_cls/foobar/net_cls.classid

       Finally some PIDs can be assigned to the given cgroup:

	      echo 1234 > /sys/fs/cgroup/net_cls/foobar/tasks
	      echo 5678 > /sys/fs/cgroup/net_cls/foobar/tasks

       Now by simply attaching a cgroup filter to a qdisc makes packets from PIDs 1234 and 5678 be pushed into class 1:2.

SEE ALSO

       tc(8), tc-ematch(8),
       the file Documentation/cgroups/net_cls.txt of the Linux kernel tree

iproute2							    21 Oct 2015 					Cgroup classifier in tc(8)