Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 3 non-root users on my server, and I want to give to each of them the different IP addresses (I have multiple IPs on one network inteface). For example, user1 will have 192.168.1.2, user2 - 192.168.1.3 and so on. Or, if it's impossible, how can I bind the specific process to the given IP address (I suggest, that it's possible to do with iptables, but how?). Thanks.

share|improve this question
    
Just out of curiosity, can you please describe the use case for this scenario? –  ztron Feb 17 '11 at 21:09
1  
One useful thing you can do with this is setup a Tor relay/exit node. Since many sites will ban the IP address of a Tor exit node, it is generally best to set one up on a dedicated IP address that you don't use for other purposes (in particular generalized non-anonymous web surfing). By using the command below, you can route all traffic from the tor daemon (which should run under its own username) out a specific IP address. The relay can still be behind your firewall in its own DMZ but still nat through it without conflicting with your primary outbound IP. –  par Mar 12 '12 at 7:43
    
Another thing you can do (an illegitimate purpose) is use this for collusion. Say for example you play online poker--most sites will allow no more than one user per IP address at any given time to ostensibly prevent people from sitting in the same room and playing the same tables where they can share information/cheat. By using this you can setup an environment where multiple people (or bots) can be in the same room and play at the same tables since each user appears to come from a different IP address. –  par Mar 12 '12 at 7:50

1 Answer 1

up vote 8 down vote accepted
iptables -t nat -A POSTROUTING -m owner --uid-owner user1 -j SNAT --to-source 192.168.1.2
iptables -t nat -A POSTROUTING -m owner --uid-owner user2 -j SNAT --to-source 192.168.1.3
iptables -t nat -A POSTROUTING -m owner --uid-owner user3 -j SNAT --to-source 192.168.1.4

It is your responsibility to make sure that (a) you are not otherwise using the POSTROUTING nat chain, so these rules don't conflict with anything else, and (b) all these IP addresses are present on your NIC (you won't hear many replies otherwise).

This will also only affect traffic originating locally from processes owned by these users. If these are users are setting up network listening daemons, a different approach will be needed to handle replies, and if the server is acting as a router, this will not work; but you did not say that either of these circumstances applied, so I have not addressed the issues.

share|improve this answer
    
I expect only outgoing network requests (such as web-surfing), I don't think, that port binding will be required. Thank you. –  user59178 Feb 17 '11 at 13:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.