15

I've actually got two scenarios to apply this:

  1. Multiseat Desktop: two network connections both with internet gateways and two accounts doing bandwidth-intensive tasks on each. I want to split them up so one account only uses eth0 and the second account only uses eth1.

  2. Server: I have two IPs on a server and I want to make sure the mail user only sends email from the second IP (eth0:1 alias)

The second can probably be IPTabled (I just don't know how) to route email traffic through that interface but the first will be dealing with all sorts of traffic so needs to be user-based. If there is a user-based solution, I could apply this in both places.

Improve this question

3 Answers 3

Reset to default
7

You could set up two virtual machines on the physical machine, and set up the network interface bridging so that one VM uses eth0 and the other VM uses eth1. See the virtual box documentation section on bridged networking.

Improve this answer
6

You'll want to use the iptables owner module and perhaps some clever packet mangling.

owner This module attempts to match various characteristics of the packet creator, for locally-generated packets. It is only valid in the OUTPUT chain, and even then some packets (such as ICMP ping responses) may have no owner, and hence never match.

--uid-owner userid Matches if the packet was created by a process with the given effective (numerical) user id.

--gid-owner groupid Matches if the packet was created by a process with the given effective (numerical) group id.

--pid-owner processid Matches if the packet was created by a process with the given process id.

--sid-owner sessionid Matches if the packet was created by a process in the given session group.

Improve this answer
2
  • You can use iptables to set the mark, which you can then use in the routing table. See the MARK and CONNMARK targets. In iproute, its then 'ip rule add fwmark X...' I wouldn't be surprised, actually, if iproute2 alone can do this...
    – derobert
    Commented Aug 20, 2010 at 18:14
  • 3
    Being someone who's done extensive work with owner matching, I can say this will not always produce the desired result. I.e., not all packets have an owner like you expect. ICMP and ESP are types that are owned by the kernel (or root) regardless of the originating application and will not be matched by -m owner. It's fairly reliable with TCP and UDP, but other types are not so reliable. The only reliable way to achieve this 100% is with VM's or containers.
    – bahamat
    Commented Aug 24, 2012 at 23:53
1

I'm not sure that's possible for the first point. You want to do some routing manipulation based on the userid of the user. Last time I check I didn't see this possibility.

For the second point, that's not iptables that you want to use but iproute2 (http://lartc.org/howto/ and http://www.policyrouting.org/iproute2.doc.html for the complete doc). It's the replacement for the ifconfig/route commands as they are considered obsolete. iproute2 allow yo to route packets according to its source. That's what you want

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .