I'm trying to determine if it is possible to selectively route IP packets from a process or process group through a specific interface while all other packets are routed through another interface. That is, I want all traffic from /usr/bin/testapp
to be routed through eth1
while all other packets go through eth0
. Packets in this case can be TCP, UDP, ICMP, etc. and can be configured by the end users to use various port(s).
Because I'm not able to easily force the process in question to bind to a specific interface, I am trying to achieve the same outcome via routing. Is this possible?
— edit —
Through a helpful suggestion here, and in many other places, is to mark packets based on UID; that is not really the goal. The goal is to mark/filter/route based on process regardless of user. That is to say, if alice
, bob
and charlie
all run their own instance of /usr/bin/testapp
; all packets from all three instances should go through eth1
while all other packets from the system should go through eth0
.
Note that marking by source/destination port, user name/UID, etc. is not sufficient since various users may run testapp
and they may setup different ports in their own ~/.config/testapp.conf
or whatever. The question is about filtering by process.
One option that is available, though I do not know how helpful it is, is to use a /bin/(ba|z)?sh
-based wrapper around the native binary.
— edit —
I'm referring to routing on a system running a modern Linux kernel, say 4.0 or better. If there are software dependencies beyond iproute2
, nftables
, conntrack
and similar tools, I'm willing to explore open source solutions, though basic tools are preferable.
Best Answer
Your routing the packets through either eth1 or eth0. tables mangle should address this. To do so, I had to mark packets and set up rules for handling it. First, add a rule that make the kernel route packets marked with 2 through table
Add a route for redirecting traffic over a different interface, assuming the gateway being 10.0.0.1:
Flush your routing Cache.
Now, set a firewall rule for marking designated packets:
Finally, relax the reverse path source validation. Some suggest you to set it to 0, but 2 seems a better choice according to
https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt
. If you skip this, you will receive packets (this can be confirmed usingtcpdump -i tap0 -n
), but packets do not get accepted. The command to change the setting so packets get accepted:Reference :
http://serverfault.com/questions/345111/iptables-target-to-route-packet-to-specific-interface