Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

PC1 is running on centOS with iptables, and has 5 ips ( assigned, and 10 users (User1 - User9). All i want is to restrict UDP and TCP traffic of a single ip ( to user (User1), so that all the incomming and outgoing udp and tcp traffic should only be used by user (User1).

(p.s I've seen many people doing this on freebsd using ipfw)

share|improve this question

closed as unclear what you're asking by Ward, masegaloeh, Khaled, kasperd, MadHatter May 25 '15 at 6:35

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

This doesn't make any sense. Users aren't "assigned" IPs and they have nothing to do with shells, network interfaces use IPs. Instead of asking something like "How do I <random nonsense>" you should explain the problem that you're trying to solve and ask what the best way to solve it is. – MDMarra Aug 22 '12 at 17:51
This may be answerable... iptables with -m owner, SELinux, etc. It may not. I've seen it asked enough that this is worth being addressed. – Jeff Ferland Aug 22 '12 at 17:58
@JeffFerland probably because assigning an IP to a user instead of device could have bad breaky-type side effects in practical use down the road, I would think. – Bart Silverstrim Aug 22 '12 at 18:07
I'm pretty familiar with ipfw's user/group matching. It's balky at best (only works for packets coming to/going from a local socket, and doesn't always catch all of them - see bahamat's answer). Network level concepts (like firewalls) should not have truck with system concepts like UIDs/GIDs. – voretaq7 Nov 11 '12 at 0:36

There really isn't a mechanism I know of for this since it would break things. What if they logged in over a VPN? Or accessed in some other remotey way? IP's can be tied/associated to devices, not people. Usernames are associated with people.

If you really want a specific user to have a specific IP, assign them a particular computer/laptop/device and allow them to only access resources from that device. In AD you can lock what computer they use, filter access by that machine's IP to the resource, etc.

share|improve this answer
i have edited my question and this time i guess i have made it clear. – Daud Khan Aug 23 '12 at 4:59

Really, the best way to do this would be to create a VM for each user and assign the IP you want them to use to the VM.

The user matching that iptables wont quite work like you expect because not all packets are owned by a user. E.g., neither ICMP nor incoming packets are "owned" by a user and therefore will never match, you can't use iptables to force applications to bind to a specific address, etc.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.