Netfilter-Devel Archive on
 help / color / Atom feed
From: Lukas Wunner <>
To: "Pablo Neira Ayuso" <>,
	Jozsef Kadlecsik <>,
	Florian Westphal <>
Cc:,,, Martin Mares <>,
	Daniel Borkmann <>
Subject: [PATCH nf-next,RFC 0/5] Netfilter egress hook
Date: Thu, 31 Oct 2019 14:41:00 +0100
Message-ID: <> (raw)

Introduce a netfilter egress hook to complement the existing ingress hook.

User space support for nft is submitted in a separate patch.

The need for this arose because I had to filter egress packets which do
not match a specific ethertype.  The most common solution appears to be
to enslave the interface to a bridge and use ebtables, but that's
cumbersome to configure and comes with a (small) performance penalty.
An alternative approach is tc, but that doesn't afford equivalent
matching options as netfilter.  A bit of googling reveals that more
people have expressed a desire for egress filtering in the past:

I am first performing traffic control with sch_handle_egress() before
performing filtering with nf_egress().  That order is identical to
ingress processing.  I'm wondering whether an inverse order would be
more logical or more beneficial.  Among other things it would allow
marking packets with netfilter on egress before performing traffic
control based on that mark.  Thoughts?

Lukas Wunner (5):
  netfilter: Clean up unnecessary #ifdef
  netfilter: Document ingress hook
  netfilter: Rename ingress hook include file
  netfilter: Generalize ingress hook
  netfilter: Introduce egress hook

 include/linux/netdevice.h         |   5 ++
 include/linux/netfilter_ingress.h |  58 -----------------
 include/linux/netfilter_netdev.h  | 102 ++++++++++++++++++++++++++++++
 include/uapi/linux/netfilter.h    |   1 +
 net/core/dev.c                    |  31 ++++++---
 net/netfilter/Kconfig             |   8 +++
 net/netfilter/core.c              |  24 +++++--
 net/netfilter/nft_chain_filter.c  |   4 +-
 8 files changed, 161 insertions(+), 72 deletions(-)
 delete mode 100644 include/linux/netfilter_ingress.h
 create mode 100644 include/linux/netfilter_netdev.h


             reply index

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-31 13:41 Lukas Wunner [this message]
2019-10-31 13:41 ` [PATCH nf-next,RFC 1/5] netfilter: Clean up unnecessary #ifdef Lukas Wunner
2019-10-31 13:41 ` [PATCH nf-next,RFC 2/5] netfilter: Document ingress hook Lukas Wunner
2019-10-31 13:41 ` [PATCH nf-next,RFC 3/5] netfilter: Rename ingress hook include file Lukas Wunner
2019-10-31 13:41 ` [PATCH nf-next,RFC 4/5] netfilter: Generalize ingress hook Lukas Wunner
2019-10-31 13:41 ` [PATCH nf-next,RFC 5/5] netfilter: Introduce egress hook Lukas Wunner
2019-10-31 22:39   ` Daniel Borkmann
2019-11-23 14:23     ` Lukas Wunner
2019-11-07 22:51 ` [PATCH nf-next,RFC 0/5] Netfilter " Pablo Neira Ayuso
2019-11-23 13:11   ` Lukas Wunner

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Netfilter-Devel Archive on

Archives are clonable:
	git clone --mirror netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ \
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone