I have 3 non-root users on my server, and I want to give to each of them the different IP addresses (I have multiple IPs on one network inteface). For example, user1 will have, user2 - and so on. Or, if it's impossible, how can I bind the specific process to the given IP address (I suggest, that it's possible to do with iptables, but how?). Thanks.

  • Just out of curiosity, can you please describe the use case for this scenario? – ztron Feb 17 '11 at 21:09
  • 1
    One useful thing you can do with this is setup a Tor relay/exit node. Since many sites will ban the IP address of a Tor exit node, it is generally best to set one up on a dedicated IP address that you don't use for other purposes (in particular generalized non-anonymous web surfing). By using the command below, you can route all traffic from the tor daemon (which should run under its own username) out a specific IP address. The relay can still be behind your firewall in its own DMZ but still nat through it without conflicting with your primary outbound IP. – par Mar 12 '12 at 7:43
  • Another thing you can do (an illegitimate purpose) is use this for collusion. Say for example you play online poker--most sites will allow no more than one user per IP address at any given time to ostensibly prevent people from sitting in the same room and playing the same tables where they can share information/cheat. By using this you can setup an environment where multiple people (or bots) can be in the same room and play at the same tables since each user appears to come from a different IP address. – par Mar 12 '12 at 7:50
  • My reasoning is that I share a workstation and a laptop with my small child. I have a separate vlan for him enforcing things like time of day and additional firewall rules. His devices live on that subnet, but I don't want mine to. – andyortlieb Jul 24 '18 at 13:11
iptables -t nat -A POSTROUTING -m owner --uid-owner user1 -j SNAT --to-source
iptables -t nat -A POSTROUTING -m owner --uid-owner user2 -j SNAT --to-source
iptables -t nat -A POSTROUTING -m owner --uid-owner user3 -j SNAT --to-source

It is your responsibility to make sure that (a) you are not otherwise using the POSTROUTING nat chain, so these rules don't conflict with anything else, and (b) all these IP addresses are present on your NIC (you won't hear many replies otherwise).

This will also only affect traffic originating locally from processes owned by these users. If these are users are setting up network listening daemons, a different approach will be needed to handle replies, and if the server is acting as a router, this will not work; but you did not say that either of these circumstances applied, so I have not addressed the issues.

  • I expect only outgoing network requests (such as web-surfing), I don't think, that port binding will be required. Thank you. – artem Feb 17 '11 at 13:37
  • @MadHatter Your solution doesnt seem to work for me, I've written a question here unix.stackexchange.com/questions/564163/… Could you see if you possibly can help me debug? – jenso Jan 26 '20 at 11:54
  • @jenso your question as written is about something subtly but importantly different: you don't want per-user source addresses, you want per-user routing tables. I'm not going to answer questions on unix.SE, but it may be that what you want is iproute2. – MadHatter Jan 26 '20 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.