Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

As the title really. I've actually got two scenarios to apply this:

  1. Multiseat Desktop: two network connections both with internet gateways and two accounts doing bandwidth-intensive tasks on each. I want to split them up so one account only uses eth0 and the second account only uses eth1.

  2. Server: I have two IPs on a server and I want to make sure the mail user only sends email from the second IP (eth0:1 alias)

The second can probably be IPTabled (I just don't know how) to route email traffic through that interface but the first will be dealing with all sorts of traffic so needs to be user-based. If there is a user-based solution, I could apply this in both places.

share|improve this question
add comment

3 Answers 3

up vote 5 down vote accepted

You'll want to use the iptables owner module and perhaps some clever packet mangling.

owner This module attempts to match various characteristics of the packet creator, for locally-generated packets. It is only valid in the OUTPUT chain, and even then some packets (such as ICMP ping responses) may have no owner, and hence never match.

--uid-owner userid Matches if the packet was created by a process with the given effective (numerical) user id.

--gid-owner groupid Matches if the packet was created by a process with the given effective (numerical) group id.

--pid-owner processid Matches if the packet was created by a process with the given process id.

--sid-owner sessionid Matches if the packet was created by a process in the given session group.

share|improve this answer
    
You can use iptables to set the mark, which you can then use in the routing table. See the MARK and CONNMARK targets. In iproute, its then 'ip rule add fwmark X...' I wouldn't be surprised, actually, if iproute2 alone can do this... –  derobert Aug 20 '10 at 18:14
3  
Being someone who's done extensive work with owner matching, I can say this will not always produce the desired result. I.e., not all packets have an owner like you expect. ICMP and ESP are types that are owned by the kernel (or root) regardless of the originating application and will not be matched by -m owner. It's fairly reliable with TCP and UDP, but other types are not so reliable. The only reliable way to achieve this 100% is with VM's or containers. –  bahamat Aug 24 '12 at 23:53
add comment

You could set up two virtual machines on the physical machine, and set up the network interface bridging so that one VM uses eth0 and the other VM uses eth1. See the virtual box documentation section on bridged networking.

share|improve this answer
add comment

I'm not sure that's possible for the first point. You want to do some routing manipulation based on the userid of the user. Last time I check I didn't see this possibility.

For the second point, that's not iptables that you want to use but iproute2 (http://lartc.org/howto/ and http://www.policyrouting.org/iproute2.doc.html for the complete doc). It's the replacement for the ifconfig/route commands as they are considered obsolete. iproute2 allow yo to route packets according to its source. That's what you want

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.