0

Suppose I have a machine on a network with two different valid, working gateways. Let's call 10.0.0.1 the "normal" gateway to the internet as supplied by an ISP and 10.0.0.2 a standalone VPN appliance that routes everything to a company's network before the big wider internet world. A side-effect of this is that they appear online from a different geographical location.

On this network, users (or their administrators) could choose which gateway to use on the basis of essentially what their DHCP server tells them, or they decide to set. This is a convenience for many -- you can have slightly faster, lower-latency access to the native country's internet via gateway A and access to internal resources (and the US internet) via gateway B.

For a machine running linux on this network, is it possible to change routes on a per application basis? I know that we could set a specific route on a per host basis with ip route if we knew in advance where we'd like to send off the packets to, but what if we want to open one application (e.g. firefox) sending all of its packets to gateway A and another (e.g. Chromium) to gateway B?

This is obviously possible with vlans, VMs (or containers) and virtual network adapters, but I'm interested to know if there's a "bare metal" answer.

2
  • 2
    VLANs and virtual network adapters won't help with that, but you can use network namespaces (instead of a full container), or policy routing, or iptables if nothing else helps.
    – dirkt
    Jan 3 at 15:56
  • @dirkt That sounds great. Could I be so rude as to ask if you have a pointer to a good resource that might help?
    – Landak
    Jan 4 at 10:11

1 Answer 1

1

If you are willing to use a different user, then this can be accomplished with a small Linux policy routing configuration.

Let's assume that you will use user with uid 1001, as the user who's applications use the VPN appliance gateway. Let's also assume that your base routing configuration is very simple and won't interfere with the policy routing configuration we are about to add.

Add a special route to use the VPN applicance:

ip route add default via 10.0.0.2 table 110

Use policy routing to apply that special route for the user with uid 1001:

ip rule add uidrange 1001-1001 lookup 110 pref 29000

Note: You'll still be using the same DNS server. Although there are ways to change that also, but that might work better using Linux namespaces.

Note: Some application (e.g. traceroute) have the setuid flag set on the binary. This would cause that application's network traffic to not match the above policy routing rule.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.