Linux outbound traffic filtering with: cgroups + tc + iptables

Operating Systems Linux Debian Linux outbound traffic filtering with: cgroups + tc + iptables

02-13-2016

Registered User

1, 0

Join Date: Feb 2016

Last Activity: 13 February 2016, 12:09 PM EST

Posts: 1

Thanks Given: 0

Thanked 0 Times in 0 Posts

Linux outbound traffic filtering with: cgroups + tc + iptables

I spent a lot of time trying to implement outbound traffic filtering with: cgroups + tc + iptables on Debian Jessie. Unfortunately there is still something wrong.
The biggest issue is:
- cgroups install + config
- net_cls subsystem implementation
- packets marking with net_cls
- appropriate (tc) traffic control konfiguration.
- iptables OUTBOUND rules is already done.
Briefly, network access only for marked (with net_cls) packets, next assigned to (created by tc) class and at least iptables roule like:
-A OUTPUT -m cgroup --cgroup 3 -j ACCEPT

I would appreciate any professional support.
Mark.

Novi

View Public Profile for Novi

Find all posts by Novi

Previous Thread | Next Thread

8 More Discussions You Might Find Interesting

1. IP Networking

Upload problem with traffic shaping though a Linux router.

So I want to limit the download and upload speed of a specific ip adress in a local network. To do this I are using a bach script running in a linux OS (Ubuntu 11.04). The issue here is that the upload shaper does not work. I have tried an alternate solution aswell though that does not work as...

2. IP Networking

Dividing traffic with u32 iptables filter

I would like to divide traffic between two squid servers. I have been thinking about using iptables u32 filter, to check last bit of ip address which is comming to gateway. Then I would like to direct even IP adresses to one squid host, and odd to the other. Is it reasonable ? Thank you for...

3. IP Networking

Traffic shaping with iptables

hello, I have a postfix & a local dns running on a single server. this server is connected to internet via a low bandwidth line(with fixed ip). we also have another high speed adsl (dynamic ip). i want to divert all dns request from the local dns & postfix from the server to the adsl...

4. Linux

Linux dhcp client boot process with packets traffic

Hi Everybody, I would like to know the entire network packets exchange, sequence between a linux dhcp client workstation & dhcp server as client comes up starting from OS booting stage as network service starts to the time client gets dhcp IP address. This would be in a typical LAN ...

5. Shell Programming and Scripting

Block incoming traffic FTP from internet using iptables

Hi everybody. I have the next scenary: eth0: WAN eth1: DMZ eth2: LAN I need to block all incoming trafic from the internet through my network LAN using iptables. I have squid but i need to do this using ipatbles. I have been listening about iptables -A FORDAWARD but I am stuck right...

6. IP Networking

Iptables/TC: how to make masqueraded traffic go through an openVPN tun0?

Hi all! We have a setup of three computers; Machine A (eth0) -> Machine B (eth0, hso0, tun0) -> Machine C (eth0, tun0) hso0 is the packet interface of a 3G modem, it behaves like a normal network interface. Machine B and C are connected in a VPN using openVPN (TCP). Machine A is a...

7. Red Hat

How to check the outbound packets in Linux

I have a linux redhat box , our security department in my company informed me that my server's IP sends So many traffic in my network , This box I am using it as FTP server to store the other servers logs . My question briefly is how to check my outbound packets which are going from my PC to the...

8. IP Networking

measuring traffic with iptables

i have a wireless network that is connected to internet over nat.there is ap that is connected to another ap in bridge mode, on ap is used for clients, and the other is connected to the machine that is doing masquerading. so i want to measure traffic of my clients and i thought about doing it with...

LEARN ABOUT POSIX

tc-fw

Firewall mark classifier in tc(8)				       Linux					 Firewall mark classifier in tc(8)

NAME

       fw - fwmark traffic control filter

SYNOPSIS

       tc filter ... fw [ classid CLASSID ] [ action ACTION_SPEC ]

DESCRIPTION

       the fw filter allows to classify packets based on a previously set fwmark by iptables.  If it is identical to the filter's handle, the fil-
       ter matches.  iptables allows to mark single packets with the MARK target, or whole connections using CONNMARK.	The benefit of using  this
       filter  instead of doing the heavy-lifting with tc itself is that on one hand it might be convenient to keep packet filtering and classifi-
       cation in one place, possibly having to match a packet just once, and on the other users familiar with iptables but not tc will have a less
       hard time adding QoS to their setups.

OPTIONS

       classid CLASSID
	      Push matching packets to the class identified by CLASSID.

       action ACTION_SPEC
	      Apply an action from the generic actions framework on matching packets.

EXAMPLES

       Take e.g. the following tc filter statement:

	      tc filter add ... handle 6 fw classid 1:1

       will match if the packet's fwmark value is 6.  This is a sample iptables statement marking packets coming in on eth0:

	      iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 6

SEE ALSO

       tc(8), iptables(8), iptables-extensions(8)

iproute2							    21 Oct 2015 				 Firewall mark classifier in tc(8)

Debian