0

I have an Ubuntu 20.04 machine with 2 ethernet interfaces with 2 IP addresses each. It's an AWS EC2 instance and each of the 4 IP addresses has an EIP attached to it via NAT. Both interfaces connect to the same internal subnet. The setup looks like this:

EC2 Machine:

- eni1:

  • private-IP1 -> public-IP1
  • private-IP2 -> public-IP2

- eni2:

  • private-IP3 -> public-IP3
  • private-IP4 -> public-IP4

All 4 addresses are reachabale from the outside so that seems to be all fine. However for outgoing traffic currently always private-IP1 (and thus public-IP1) gets used. I want to specify that individual SSH users use specific IP addresses, so they'll come from the corresponding public IP when talking to services on the internet i.e.

user1 -> private-IP1

user2 -> private-IP2

user3 -> private-IP3

user4 -> private-IP4

What's the best way of achieving this result?

3
  • Any chance you could run 802.1X? You could assign IP addresses based on RADIUS authentication.
    – Zac67
    Jan 7, 2022 at 22:11
  • hmm, I guess it would be an option. Never worked with RADIUS authentication before. Are you aware of any resources I could check to get me started for this?
    – MoWo
    Jan 8, 2022 at 8:59
  • No, sorry - requests for resources are off-topic here anyway. You should explore which options you've got an EC2. While a RADIUS server could be easily added, 802.1X needs to be provided by the cloud (unless you put a complete virtualization layer on top).
    – Zac67
    Jan 8, 2022 at 10:39

2 Answers 2

1

The best way to achieve that would be to clone the EC2 instance into four instances, assign each clone one IP address, and let each user use only the machine having the IP address he or she should use.

6
  • Interesting approach but not what I'm looking for. I am planning on scaling this up to more IPs in the long run and deploying a fleet of instances just for this purpose seems wasteful and will create a lot of maintenance overhead.
    – MoWo
    Jan 7, 2022 at 20:01
  • 1
    Sorry, all other solutions I can think of will create even more maintenance overhead. Jan 7, 2022 at 23:06
  • But there must be a way to tell a linux kernel to make use of the different routes it has available. It works for traffic passing through the box, why should it not work for traffic originating in the box?
    – MoWo
    Jan 8, 2022 at 6:41
  • Of course there is. The difficulty is to make that routing decision dependent on the user ID. The traffic itself bears no information about the user who initiated it. Simply put, you'll have to create and maintain a mechanism to map UIDs to source IP addresses and to tell the networking stack to use it instead of its normal user-agnostic mechanism. Again, creating a separate instance for each user is by far the easiest way to achieve that. Jan 8, 2022 at 14:09
  • hmmm. I did try using -m owner in iptables to match traffic to the user, mark the packets and then use ip rules to map them to a specific routing table. Unfortunately it's not working so I was looking for alternatives... I still think it must be possible or that a workaround must exist. I just can't figure it out...
    – MoWo
    Jan 8, 2022 at 14:21
1

I finally solved this myself after pouring many hours into this. In the end I got it to work by adding an ip rule like so:

sudo ip rule add uidrange 1000-1001 lookup if1
sudo ip rule add uidrange 1002-1004 lookup if2

and then adding iptables postrouting rules like this:

$ sudo iptables -S -t nat
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -o interface1 -m owner --uid-owner 1000 -j SNAT --to-source IP1
-A POSTROUTING -o interface1 -m owner --uid-owner 1001 -j SNAT --to-source IP2
-A POSTROUTING -o interface2 -m owner --uid-owner 1002 -j SNAT --to-source IP3
-A POSTROUTING -o interface2 -m owner --uid-owner 1003 -j SNAT --to-source IP3

with if1 and if2 being my custom route tables containing the corresponding default routes. Works well! Maybe this can be useful for someone in the future :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .