Is it possible to set different default gateways on a per-application basis?

Question

Suppose I have a machine on a network with two different valid, working gateways. Let's call 10.0.0.1 the "normal" gateway to the internet as supplied by an ISP and 10.0.0.2 a standalone VPN appliance that routes everything to a company's network before the big wider internet world. A side-effect of this is that they appear online from a different geographical location.

On this network, users (or their administrators) could choose which gateway to use on the basis of essentially what their DHCP server tells them, or they decide to set. This is a convenience for many -- you can have slightly faster, lower-latency access to the native country's internet via gateway A and access to internal resources (and the US internet) via gateway B.

For a machine running linux on this network, is it possible to change routes on a per application basis? I know that we could set a specific route on a per host basis with ip route if we knew in advance where we'd like to send off the packets to, but what if we want to open one application (e.g. firefox) sending all of its packets to gateway A and another (e.g. Chromium) to gateway B?

This is obviously possible with vlans, VMs (or containers) and virtual network adapters, but I'm interested to know if there's a "bare metal" answer.

Answer 1

If you are willing to use a different user, then this can be accomplished with a small Linux policy routing configuration.

Let's assume that you will use user with uid 1001, as the user who's applications use the VPN appliance gateway. Let's also assume that your base routing configuration is very simple and won't interfere with the policy routing configuration we are about to add.

Add a special route to use the VPN applicance:

ip route add default via 10.0.0.2 table 110

Use policy routing to apply that special route for the user with uid 1001:

ip rule add uidrange 1001-1001 lookup 110 pref 29000

Note: You'll still be using the same DNS server. Although there are ways to change that also, but that might work better using Linux namespaces.

Note: Some application (e.g. traceroute) have the setuid flag set on the binary. This would cause that application's network traffic to not match the above policy routing rule.