I have two users, alpha (uid 500) and beta (uid 501), and two IP addresses assigned as eth0 and eth0:1. I would like all outgoing packets originated by processes started by user alpha to be marked with the source IP address of eth0, and all packets from user beta's processes to be marked with the source IP address of eth0:1.
From searching the available answers on this forum and elsewhere, I found that I should do something like this:
# mark packets with 11 or 12 depending which user they came from:
iptables -A OUTPUT -m owner --uid-owner 500 -j MARK --set-mark 11
iptables -A OUTPUT -m owner --uid-owner 501 -j MARK --set-mark 12
# now, for a packet having mark 11 (or 12), set source IP to 192.168.1.1 (or .2)
iptables -t nat -I POSTROUTING -m connmark --mark 11 -j SNAT --to-source 192.168.1.1
iptables -t nat -I POSTROUTING -m connmark --mark 12 -j SNAT --to-source 192.168.1.2
Would the above work? Is there a simpler (one-step, instead of two-step) setup?
How can I use tcpdump
to verify that it works, indeed?