Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

PC1 is running on centOS with iptables, and has 5 ips ( assigned, and 10 users (User1 - User9). All i want is to restrict UDP and TCP traffic of a single ip ( to user (User1), so that all the incomming and outgoing udp and tcp traffic should only be used by user (User1).

(p.s I've seen many people doing this on freebsd using ipfw)

share|improve this question
This doesn't make any sense. Users aren't "assigned" IPs and they have nothing to do with shells, network interfaces use IPs. Instead of asking something like "How do I <random nonsense>" you should explain the problem that you're trying to solve and ask what the best way to solve it is. –  MDMarra Aug 22 '12 at 17:51
This may be answerable... iptables with -m owner, SELinux, etc. It may not. I've seen it asked enough that this is worth being addressed. –  Jeff Ferland Aug 22 '12 at 17:58
@JeffFerland probably because assigning an IP to a user instead of device could have bad breaky-type side effects in practical use down the road, I would think. –  Bart Silverstrim Aug 22 '12 at 18:07
I'm pretty familiar with ipfw's user/group matching. It's balky at best (only works for packets coming to/going from a local socket, and doesn't always catch all of them - see bahamat's answer). Network level concepts (like firewalls) should not have truck with system concepts like UIDs/GIDs. –  voretaq7 Nov 11 '12 at 0:36

2 Answers 2

There really isn't a mechanism I know of for this since it would break things. What if they logged in over a VPN? Or accessed in some other remotey way? IP's can be tied/associated to devices, not people. Usernames are associated with people.

If you really want a specific user to have a specific IP, assign them a particular computer/laptop/device and allow them to only access resources from that device. In AD you can lock what computer they use, filter access by that machine's IP to the resource, etc.

share|improve this answer
i have edited my question and this time i guess i have made it clear. –  Daud Khan Aug 23 '12 at 4:59

Really, the best way to do this would be to create a VM for each user and assign the IP you want them to use to the VM.

The user matching that iptables wont quite work like you expect because not all packets are owned by a user. E.g., neither ICMP nor incoming packets are "owned" by a user and therefore will never match, you can't use iptables to force applications to bind to a specific address, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.