9

I have 3 non-root users on my server, and I want to give to each of them the different IP addresses (I have multiple IPs on one network inteface). For example, user1 will have 192.168.1.2, user2 - 192.168.1.3 and so on. Or, if it's impossible, how can I bind the specific process to the given IP address (I suggest, that it's possible to do with iptables, but how?). Thanks.

4
  • Just out of curiosity, can you please describe the use case for this scenario?
    – ztron
    Feb 17, 2011 at 21:09
  • 1
    One useful thing you can do with this is setup a Tor relay/exit node. Since many sites will ban the IP address of a Tor exit node, it is generally best to set one up on a dedicated IP address that you don't use for other purposes (in particular generalized non-anonymous web surfing). By using the command below, you can route all traffic from the tor daemon (which should run under its own username) out a specific IP address. The relay can still be behind your firewall in its own DMZ but still nat through it without conflicting with your primary outbound IP.
    – par
    Mar 12, 2012 at 7:43
  • Another thing you can do (an illegitimate purpose) is use this for collusion. Say for example you play online poker--most sites will allow no more than one user per IP address at any given time to ostensibly prevent people from sitting in the same room and playing the same tables where they can share information/cheat. By using this you can setup an environment where multiple people (or bots) can be in the same room and play at the same tables since each user appears to come from a different IP address.
    – par
    Mar 12, 2012 at 7:50
  • My reasoning is that I share a workstation and a laptop with my small child. I have a separate vlan for him enforcing things like time of day and additional firewall rules. His devices live on that subnet, but I don't want mine to. Jul 24, 2018 at 13:11

1 Answer 1

12
iptables -t nat -A POSTROUTING -m owner --uid-owner user1 -j SNAT --to-source 192.168.1.2
iptables -t nat -A POSTROUTING -m owner --uid-owner user2 -j SNAT --to-source 192.168.1.3
iptables -t nat -A POSTROUTING -m owner --uid-owner user3 -j SNAT --to-source 192.168.1.4

It is your responsibility to make sure that (a) you are not otherwise using the POSTROUTING nat chain, so these rules don't conflict with anything else, and (b) all these IP addresses are present on your NIC (you won't hear many replies otherwise).

This will also only affect traffic originating locally from processes owned by these users. If these are users are setting up network listening daemons, a different approach will be needed to handle replies, and if the server is acting as a router, this will not work; but you did not say that either of these circumstances applied, so I have not addressed the issues.

4
  • I expect only outgoing network requests (such as web-surfing), I don't think, that port binding will be required. Thank you.
    – artem
    Feb 17, 2011 at 13:37
  • @MadHatter Your solution doesnt seem to work for me, I've written a question here unix.stackexchange.com/questions/564163/… Could you see if you possibly can help me debug?
    – james
    Jan 26, 2020 at 11:54
  • @jenso your question as written is about something subtly but importantly different: you don't want per-user source addresses, you want per-user routing tables. I'm not going to answer questions on unix.SE, but it may be that what you want is iproute2.
    – MadHatter
    Jan 26, 2020 at 13:16
  • For anyone wondering why dns isn't working on that user after trying this, it's because the user doesn't have access to the loopback interface anymore. The solution is to specify the interface used for internet access in this iptables rule: -o en1 for example
    – Tiago
    Mar 11, 2021 at 15:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .