[LARTC] Routing based on user id

[LARTC] Routing based on user id

[Jürgen Jacob]

Hi,
on page 3 of the lartc HOWTO one can read that it's possible to do 
routing based on user id.
Can someone explain me how to do this? And is it somehow possible to set 
the DSCP depending on the user id?

Thanks,
Jürgen Jacob

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Routing based on user id

[Anton Glinkov]

> Hi,
> on page 3 of the lartc HOWTO one can read that it's possible to do
> routing based on user id.
> Can someone explain me how to do this? And is it somehow possible to set
> the DSCP depending on the user id?
>
> Thanks,
> Jürgen Jacob

you can use the owner module in iptables

iptables -m owner -h

for DSCP you can use -j DSCP

here is a solution with fwmark:

e.g iptables -t mangle -A OUTPUT -m owner --uid-owner 0 -j MARK --set-mark 1
and then
ip rule add fwmark 0x01 table 1

after that you add all the route in table 1

ip route add ...... via ..... table 1

--
Anton Glinkov
network administrator

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

[LARTC] routing based on user id

[MIchael]

Hi all!

I've got 2 (soon 3) internet connection. 1 - via ADSL, 2(and3) via ppp
My network:
http://desima.objectis.net/network-diag

linux1:
user1.user2
eth0\x192.168.1.1
ppp0\x192.168.5.2( gw 192.168.5.1)
gw\x192.168.1.2 ( thru ADSL)
compA\x192.168.1.6
compB\x192.168.1.15
gw2\x192.168.1.217  via ppp to different ISP


All works for compA and CompB, 
user1 should use default gw(192.168.1.2)
user2 should use ppp0

For user2 it will work only if I change his route thru gw2(not ppp0):

iptables -A OUTPUT -t mangle -m owner --uid-owner 1006 -j MARK --set-mark=0x1
ip rule add fwmark 0x01 table gw2
ip route add default via 192.168.1.217 table gw2
ip route flush cache

But If I change his route via ppp0 (table T2)  all traffic stop for him
but will work ok for users CompA and B (using SNAT)
iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to-source 192.168.7.2

According to tcpdump packets going:
192.168.5.2>200.200.200.200 
and back 192.168.5.2<200.200.200.200
but for some reason not reaching user2

How I can enable routing thru ppp0 for user2?
(I will need it lateer for user3 using ppp1)

Any help greatly appreciated

Configs:
ip rule ls:
0: from all lookup local
32750: from all fwmark 0x1 lookup T2
32751: from 192.168.5.2 lookup T2
32752: from 192.168.5.1 lookup T2
32756: from 192.168.1.6 lookup T1
32757: from 192.168.1.15 lookup T2
32766: from all lookup main
32767: from all lookup default

ip route table T2
192.168.5.0 dev ppp0 scope link src 192.168.5.2
192.168.1.0/24 dev eth0 scope link
127.0.0.0/8 dev lo scope link
default via 192.168.5.1 dev ppp0

ip route ls
192.168.1.0 dev eth0 scope link src 192.168.1.1
192.168.5.1 dev ppp0 proto kernel scope link src 192.168.5.2
203.97.61.42 via 192.168.1.2 dev eth0
192.168.1.0/24 dev eth0 scope link
127.0.0.0/8 dev lo scope link
default via 192.168.1.2 dev eth0
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

[LARTC] routing based on user id

[Michael]

[-- Attachment #1: Type: text/plain, Size: 1890 bytes --]

Hi all!

I've got 2 (soon 3) internet connection. 1 - via ADSL, 2(and3) via ppp
My network:
http://desima.objectis.net/network-diag

linux1:
user1.user2
eth0=192.168.1.1
ppp0=192.168.5.2( gw 192.168.5.1)
gw=192.168.1.2 ( thru ADSL)
compA=192.168.1.6
compB=192.168.1.15
gw2=192.168.1.217  via ppp to different ISP


All works for compA and CompB,
user1 should use default gw(192.168.1.2)
user2 should use ppp0

For user2 it will work only if I change his route thru gw2(not ppp0):

iptables -A OUTPUT -t mangle -m owner --uid-owner 1006 -j MARK --set-mark=0x1
ip rule add fwmark 0x01 table gw2
ip route add default via 192.168.1.217 table gw2
ip route flush cache

But If I change his route via ppp0 (table T2)  all traffic stop for him
but will work ok for users CompA and B (using SNAT)
iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to-source 192.168.7.2

According to tcpdump packets going:
192.168.5.2>200.200.200.200
and back 192.168.5.2<200.200.200.200
but for some reason not reaching user2

How I can enable routing thru ppp0 for user2?
(I will need it lateer for user3 using ppp1)

Any help greatly appreciated

Configs:
ip rule ls:
0: from all lookup local
32750: from all fwmark 0x1 lookup T2
32751: from 192.168.5.2 lookup T2
32752: from 192.168.5.1 lookup T2
32756: from 192.168.1.6 lookup T1
32757: from 192.168.1.15 lookup T2
32766: from all lookup main
32767: from all lookup default

ip route table T2
192.168.5.0 dev ppp0 scope link src 192.168.5.2
192.168.1.0/24 dev eth0 scope link
127.0.0.0/8 dev lo scope link
default via 192.168.5.1 dev ppp0

ip route ls
192.168.1.0 dev eth0 scope link src 192.168.1.1
192.168.5.1 dev ppp0 proto kernel scope link src 192.168.5.2
203.97.61.42 via 192.168.1.2 dev eth0
192.168.1.0/24 dev eth0 scope link
127.0.0.0/8 dev lo scope link
default via 192.168.1.2 dev eth0

[-- Attachment #2: local-map.png --]
[-- Type: image/png, Size: 27314 bytes --]

[-- Attachment #3: Type: text/plain, Size: 143 bytes --]

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc