Linux – Bind Process or User to Specific IP on Linux

debianipiptableslinux

I have 3 non-root users on my server, and I want to give to each of them the different IP addresses (I have multiple IPs on one network inteface). For example, user1 will have 192.168.1.2, user2 – 192.168.1.3 and so on. Or, if it's impossible, how can I bind the specific process to the given IP address (I suggest, that it's possible to do with iptables, but how?). Thanks.

Best Answer

iptables -t nat -A POSTROUTING -m owner --uid-owner user1 -j SNAT --to-source 192.168.1.2
iptables -t nat -A POSTROUTING -m owner --uid-owner user2 -j SNAT --to-source 192.168.1.3
iptables -t nat -A POSTROUTING -m owner --uid-owner user3 -j SNAT --to-source 192.168.1.4

It is your responsibility to make sure that (a) you are not otherwise using the POSTROUTING nat chain, so these rules don't conflict with anything else, and (b) all these IP addresses are present on your NIC (you won't hear many replies otherwise).

This will also only affect traffic originating locally from processes owned by these users. If these are users are setting up network listening daemons, a different approach will be needed to handle replies, and if the server is acting as a router, this will not work; but you did not say that either of these circumstances applied, so I have not addressed the issues.

Related Topic