TC-FW(8)

✨ NAME ✨

Firewall mark classifier in tc(8) 🎀 okay so this page is all about fw, the fwmark traffic control filter. It's giving packet sorting based on marks, and it's honestly iconic 💅

tc filter ... fw [ classid CLASSID ] [ action ACTION_SPEC ]

🌸 SYNOPSIS 🌸

Here's the shape of the command. Anything in italics is a placeholder you swap out for your own stuff 🫶

tc filter ... fw [ classid CLASSID ] [ action ACTION_SPEC ]

💖 DESCRIPTION 💖

Okay so bestie, the fw filter lets you classify packets based on a fwmark that was already set by iptables 🔥 If the masked value of the fwmark matches the filter's masked handle, the filter matches. By default, all 32 bits of the handle and the fwmark get masked, so every single bit has to line up.

iptables can mark single packets with the MARK target, or mark whole connections using CONNMARK. Lowkey the best part is that you don't have to do all the heavy lifting inside tc itself 🧚 You can keep your packet filtering and classification in one place, which means you might only have to match a packet once. And if you're someone who knows iptables but not tc, this filter means way less struggle when you're adding QoS to your setups ✨ The vibe is literally efficiency.

🦋 OPTIONS 🦋

• classid CLASSID — Pushes matching packets into the class identified by CLASSID 💜
• action ACTION_SPEC — Applies an action from the generic actions framework to matching packets 💅

🍓 EXAMPLES 🍓

Let's look at this together, okay? Take e.g. the following tc filter statement:

tc filter add ... handle 6 fw classid 1:1

This will match if the packet's fwmark value is 6. No cap, that's the whole thing 😭

Here's a sample iptables statement that marks packets coming in on eth0:

iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 6

Now, if you want to set specific bits of the packet's fwmark, you can use the skbedit action 🌈 For example, to only set one bit of the fwmark without changing any other bit:

tc filter add ... action skbedit mark 0x8/0x8

The fw filter can then match on that bit by masking the handle:

tc filter add ... handle 0x8/0x8 fw action drop

This is super useful when different bits of the fwmark are assigned different meanings 👑

🌟 SEE ALSO 🌟

Want more? Check out these:

• tc(8)
• iptables(8)
• iptables-extensions(8)
• tc-skbedit(8)

Bestie, that's the whole page 💜 Source: iproute2, last updated 21 Oct 2015 🫶✨