Also, if you choose not to use the `iptables` command line utility and want to handle network isolation by directly chatting with the kernel over a netlink sock

Also, if you choose not to use the `iptables` command line utility and want to handle network isolation by directly chatting with the kernel over a netlink socket, then you basically have to cargo cult someone else's implementation. AFAIK the clearest documentation has been reading the Docker networking code. https://man7.org/linux/man-pages/man7/rtnetlink.7.html https://man7.org/linux/man-pages/man7/rtnetlink.7.html