Use iptables to DSCP tag traffic from a particular docker container
 

Without docker, this command would allow me to tag traffic from a particular application that I wanted to (via openwrt split tunnel plugin) route out my VPN: sudo iptables -t mangle -A OUTPUT -p tcp -m owner --uid-owner vpnuser -j DSCP --set-dscp 0x10

I can test this with something like: sudo -u vpnuser -- curl ipinfo.io

So - I have made my docker container run as the user in question.

But docker creates a big mess in iptables, and I'm afraid I don't know iptables well enough to understand what's going on, so I don't know where to put my tagging. The existing command I use works for regular applications still, but not for the docker container running under the user I specified because I guess the docker packets are being redirected?.

Here is what it looks like:

Hmmm.

As far as the kernel is concerned the packets from your docker containers aren't created locally, and there is no socket associated with them and thus no owner information. I think. Docker containers use virtual machine technology and have a virtual ethernet device dedicated to them. As far as the host kernel is concerned, there is no difference between traffic from a docker image and that from another physical machine.

The man page says the owner module can only be used in the OUTPUT and POSTROUTING chains, so you could try:

But, I still think it won't work, because the kernel doesn't know the owner for those packets.

I think the easiest way of tagging your traffic is going to be via the source IP or MAC addresses. And, make sure that your docker container has a fixed one of whichever you choose.

EDIT: Correcting a mistake. Or, at the least, striking something that might cause an off topic discussion.

Thank you so much for this, this makes a tonne of sense. I did try the command mentioned and you're right, it didn't work. However, you make a great suggestion. Since docker has a simpler built-in way of identifying the traffic, why not use that. I couldn't see the forest for the trees :) I have made my container keep the dynamic MAC it had as static. But I'm still stymied on where to apply my matching rule? It seems like DSCP tagging can only be applied in certain places too.

Thanks for your help!

A little more meditation and trial and error and this worked for me, please comment if you think there's a problem here:

Thank you for your help!

Sorry, I should've double checked that too.

In terms of what you've ended up with: it looks fine to me.

Thank you so much, this seems to work and I have it persistent now.