1Firewall mark classifier in tc(8)    Linux   Firewall mark classifier in tc(8)
2
3
4

NAME

6       fw - fwmark traffic control filter
7

SYNOPSIS

9       tc filter ... fw [ classid CLASSID ] [ action ACTION_SPEC ]
10

DESCRIPTION

12       the  fw filter allows one to classify packets based on a previously set
13       fwmark by iptables.  If the masked value of the fwmark matches the fil‐
14       ter's masked handle, the filter matches. By default, all 32 bits of the
15       handle and the fwmark are masked.  iptables allows one to  mark  single
16       packets with the MARK target, or whole connections using CONNMARK.  The
17       benefit of using this filter instead of doing the heavy-lifting with tc
18       itself  is  that on one hand it might be convenient to keep packet fil‐
19       tering and classification in one place,  possibly  having  to  match  a
20       packet just once, and on the other users familiar with iptables but not
21       tc will have a less hard time adding QoS to their setups.
22

OPTIONS

24       classid CLASSID
25              Push matching packets to the class identified by CLASSID.
26
27       action ACTION_SPEC
28              Apply an action from the generic actions framework  on  matching
29              packets.
30

EXAMPLES

32       Take e.g. the following tc filter statement:
33
34              tc filter add ... handle 6 fw classid 1:1
35
36       will  match  if the packet's fwmark value is 6.  This is a sample ipta‐
37       bles statement marking packets coming in on eth0:
38
39              iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 6
40
41       Specific bits of the packet's fwmark can be set using the  skbedit  ac‐
42       tion.  For  example, to only set one bit of the fwmark without changing
43       any other bit:
44
45              tc filter add ... action skbedit mark 0x8/0x8
46
47       The fw filter can then be used to match on this bit by masking the han‐
48       dle:
49
50              tc filter add ... handle 0x8/0x8 fw action drop
51
52       This is useful when different bits of the fwmark are assigned different
53       meanings.
54

SEE ALSO

56       tc(8), iptables(8), iptables-extensions(8), tc-skbedit(8)
57
58
59
60iproute2                          21 Oct 2015Firewall mark classifier in tc(8)