path: root/extensions/
diff options
authorFlorian Westphal <>2013-05-06 21:07:38 +0200
committerFlorian Westphal <>2013-05-06 21:07:38 +0200
commitccbf6b6448a4210432b76fd4660798705b05f8c4 (patch)
treef41c1d1b789dd50d77c4570b841db4cfc3506fd3 /extensions/
parentca376fcbe51b9a102a490545957d5fee69e253e1 (diff)
extensions: add connlabel match
allows to "tag" connections with up to 128 label names. Labels are defined in /etc/xtables/connlabel.conf, example: 0 from eth0 1 via eth0 Labels can then be attached to flows, e.g. -A PREROUTING -i eth0 -m connlabel --label "from eth0" --set Signed-off-by: Florian Westphal <>
Diffstat (limited to 'extensions/')
1 files changed, 32 insertions, 0 deletions
diff --git a/extensions/ b/extensions/
new file mode 100644
index 00000000..9fd2043d
--- /dev/null
+++ b/extensions/
@@ -0,0 +1,32 @@
+Module matches or adds connlabels to a connection.
+connlabels are similar to connmarks, except labels are bit-based; i.e.
+all labels may be attached to a flow at the same time.
+Up to 128 unique labels are currently supported.
+[\fB!\fP] \fB\-\-label\fP \fBname\fP
+matches if label \fBname\fP has been set on a connection.
+Instead of a name (which will be translated to a number, see EXAMPLE below),
+a number may be used instead. Using a number always overrides connlabel.conf.
+if the label has not been set on the connection, set it.
+Note that setting a label can fail. This is because the kernel allocates the
+conntrack label storage area when the connection is created, and it only
+reserves the amount of memory required by the ruleset that exists at
+the time the connection is created.
+In this case, the match will fail (or succeed, in case \fB\-\-label\fP
+option was negated).
+Label translation is done via the \fB/etc/xtables/connlabel.conf\fP configuration file.
+0 eth0-in
+1 eth0-out
+2 ppp-in
+3 ppp-out
+4 bulk-traffic
+5 interactive