Distinguish traffic from NAT interface.

[fromer]

Is it possible to distinguish traffic from guest box with NAT interface (exact setting "Attached to: NAT")?

I need to apply iptables rules on the traffic from virtualbox guest, so netfilter's mark would be great if it's possible to set.

[noteirak]

AFAIK that's not possible. iptables doesn't have a good mechanism to distinguish an application other than the PID or the user/group owner (regardless of application).

My advise would be to use Host-Only with NATing in the host and filter on that.

[fromer]

My advise would be to use Host-Only with NATing in the host and filter on that.

Can't do that unfortunately. Which of the virtualbox processes initiate the traffic? Maybe force it to run under different GID?

[noteirak]

If you run the VM with the GUI, it will be the VirtualBox process.
If you run without the GUI (in the background), it will be the VBoxHeadless process.