I had to route multiple users to their own network interface. The best solution I found to accomplish this was with
iptables owner match.
First off, you need a dedicated network interface. It doesn't really matter which method you choose to make this, for the sake of convenience I created an SSH Tunnel via a TAP interface. Here's some instructions that helped me achieving that:
Basically I used this line:
localhost:~ ssh -w any -o tunnel=ethernet root@192.168.xxx.xxx
localhost:~ ifconfig tap0 up 10.0.9.2
remotehost:~ ifconfig tap0 up 10.0.9.1
This automatically created the interface tap0 on both, local and remote host. I only assigned IP adresses to them and it worked kind of out-of-the-box. Note that you have to be
root on both machines.
For sure one could also use
OpenVPN,
IPSec,
n2n, or any other VPN Solution.
Once you set up your VPN and added a dedicated user, drop the following lines on your "source" machine (the one with the user which should be routed).
Note that you probably have to adjust the argument for uid-owner (the UID of the user obviously), the name of the interface (tap0 in my case) and the addresses for SNAT source and gateway. In my case 10.0.9.2 is the address of the source machine and 10.0.9.1 is from my gateway, the SSH Server i was connecting to.
# mark all packages from User ID 1006 with target number 5 (You can choose any number, just be consistent and make sure its not used by any other rules!)
~/ iptables -t mangle -A OUTPUT -m owner --uid-owner 1006 -j MARK --set-mark 5
# set up source natting for packages marked with target #5 (is this necessary, it's the same machine?!)
~/ iptables -t nat -A POSTROUTING -o tap0 -m mark --mark 5 -j SNAT --to-source 10.0.9.2
# use routing table 5 for packages marked with target #5
~/ ip rule add fwmark 5 table 5
# route all packages from routing table 5 through tap0 via 10.0.9.1 gateway
~/ ip route add default via 10.0.9.1 dev tap0 table 5
Allright, now that the route is set up, you probably need ip forwarding on the server machine (the one running the SSH Server), otherwise you only reach the server itself and nothing further. The easiest is probably to use
Masquerading.
# turn on ip forwarding
~/ echo 1 > /proc/sys/net/ipv4/ip_forward
# masquerade packets dedicated for interface eth0
~/ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# forward packets coming from tap0 to eth0
~/ iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT
# forward packets coming from eth0 back to tap0
~/ iptables -A FORWARD -i eth0 -o tap0 -m state --state RELATED,ESTABLISHED -j ACCEPT
Now that's everything set up you can check if your route works.
log in to your "source" machine, and check which route is used when contacting a host which should be reachable:
# find some ip address
~/ dig +short google.com | head -n1
64.15.113.39
first, try as a "normally" routed user:
~/ ip route get 64.15.113.39
64.15.113.39 via 192.168.2.1 dev wlan0 src 192.168.2.102
cache ipid 0x85d4 rtt 27ms rttvar 121ms cwnd 10
then, log in as our specially treated user and try the same. You should get a different result:
~/ ip route get 64.15.113.39
64.15.113.39 via 10.0.9.1 dev tap0 src 10.0.9.2
cache
works like a charm...
