Welcome to the most active Linux Forum on the web.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 12-21-2010, 11:58 AM   #1
LQ Newbie
Registered: Dec 2010
Posts: 2

Rep: Reputation: 0
per user routing (with iptables and iproute2)


I would like to set up a routing scheme, that allows to route traffic generated by a special user through a different network/network card. I have two network cards (eth0 and eth1), both of which have access to the internet (through a router). The default route goes through eth1 and the traffic of the special user should be routed through eth0.

I have tried the following iptables/iproute2 rules:

iptables -A OUTPUT -t mangle -m owner --uid-owner 1000 -j MARK --set-mark 1
ip rule add fwmark 1 table user1000
ip route add default dev eth0 table user1000
ip route flush cache

This however does not work for me. I can ping the router of the network connected to eth0, but i cannot access the internet (through e.g. ping or a webbrowser).

I am a newbie to iptables and iproute2 and am kind of stuck at the moment. I would really appreciate any tips or hits.

Is there maybe another possibility to achieve per user (or per application) routing?

Old 12-22-2010, 08:35 AM   #2
Senior Member
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
How many users can simultaneously go online from this Linux box?
Old 12-23-2010, 08:33 AM   #3
LQ Newbie
Registered: Dec 2010
Posts: 2

Original Poster
Rep: Reputation: 0
At the moment its only two users. But, i only want to route the traffic of one special user.
Old 01-10-2011, 03:46 PM   #4
Senior Member
Registered: Sep 2009
Location: Srbobran, Serbia
Distribution: CentOS 5.5 i386 & x86_64
Posts: 1,118
Blog Entries: 1

Rep: Reputation: 129Reputation: 129
You probably need masquerade rules.

If that is not the problem, then use Shorewall in Multy-ISP mode.
Old 08-08-2011, 05:45 PM   #5
LQ Newbie
Registered: Aug 2011
Posts: 2

Rep: Reputation: Disabled
Bump. I've tried about the same thing (marking packets, then using iproute2) but I get the same results. Additionally, pinging an external server works fine... but as soon as I try a traceroute or anything else, it fails. Obviously DNS lookups fail too.
Old 08-09-2011, 03:16 PM   #6
Senior Member
Registered: Sep 2009
Location: Srbobran, Serbia
Distribution: CentOS 5.5 i386 & x86_64
Posts: 1,118
Blog Entries: 1

Rep: Reputation: 129Reputation: 129
What I in esence use with Shorewall is this:

:br0_snat - [0:0]
iptables -A POSTROUTING -o br0 -j br0_snat 
iptables -A br0_snat -m owner --uid-owner jdownloader1 -j SNAT --to-source 
iptables -A br0_snat -m owner --uid-owner jdownloader2 -j SNAT --to-source 
iptables -A br0_snat -m owner --uid-owner jdownloader3 -j SNAT --to-source 
iptables -A br0_snat -m owner --uid-owner jdownloader4 -j SNAT --to-source 
iptables -A br0_snat -m owner --uid-owner jdownloader5 -j SNAT --to-source
And it is basically all that you should need to redirect traffic to secondary addresses.

Then use routing to redirect traffic that has those IP's as sources. I would recommend using some other box in between for actual routing for easier setup.

I always used specialized routers, or Shorewall Multi-ISP, not messing with Linux routing manualy so I will not be helping you with actual routing issue, but most of the routing issues is created when packet goes out one way and reply comes back the other way, so you need to make sure that packets are accepted on the correct interface AND IP. This part is why I suggest Shorewall Multi-ISP, since it deals with replies automaticaly.

Last edited by DrLove73; 08-09-2011 at 03:17 PM.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables-save type command for iproute2 commands? fmillion Linux - Networking 1 11-29-2009 08:22 PM
iproute2 + iptables + multiple routes + squid + with kernel 2.6.29 oskrchile Linux - Networking 3 05-08-2009 04:39 AM
Some help with iptables and iproute2 or route Histamine Linux - Networking 1 11-28-2007 02:53 PM
iptables and iproute2+tc source code thanhnx Linux - Networking 1 02-19-2003 07:39 AM
routing with iptables Han_Solo Linux - Security 0 10-28-2001 06:04 PM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 01:17 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration