Make a process having a different source IP?

dj_farid · l33t Joined: 14 Jun 2004 Posts: 613

I run rtorrent locally on my gentoo firewall. The firewall does NAT for the rest of my private LAN.

I would like rtorrent, and rtorrent only to look as if it comes from a different IP address on my firewall/router.
I am not sure how to make it as I want.

I want to mark every packet that comes out from rtorrent with iptables, so that I can shape the traffic (make it go into a different que as the rest of the traffic). There is no good way to do this other than bind the rtorrent to another IP, that I know of.
I have no control over the source or destination ports for rtorrent, only the port it listens on. So marking packets based on ports is a no go.
I have tried l7-filter and pp2p for marking, without luck (since rtorrent is running on the local (same as iptables) machine l7-filter sees only the traffic one way, which is not enough to make the pattern).

Can I somehow make it look like traffic to and from rtorrent comes and goes to some other IP than the public IP that it is on now?
If I could make it that way, I could mark packets based on source ports, and shape the traffic that way.

I was thinking something like making a fake interface on the router, then bind rtorrent to it somehow.

Any suggestions are welcome.

KWhat · l33t Joined: 04 Sep 2005 Posts: 660 Location: Los Angeles

dj_farid · l33t Joined: 14 Jun 2004 Posts: 613

That sounds like something that might work. Thanks for pointing me on the right direction.

I have two physical interfaces on the machine.
Eth0 is on the outside with a public IP, eth1 on the inside with a private IP.
I have to bind rtorrent on the inside interface, eth1, since I don't have a "spare" public IP, right?

If I bind rtorrent to say 192.168.0.20, how does it traverse through netfilter?
Does it go through FORWARD, or is it a local thing (OUTPUT and INPUT)?

KWhat · l33t Joined: 04 Sep 2005 Posts: 660 Location: Los Angeles

Yes you need to bind to the internal nic. As far as the NAT and rules are setup this is going to be highly dependent on your needs. Generally the ip alias should look as though its just another box on the LAN to the router (Private NIC + Private IP == LAN Traffic). Assuming your using one of those ip tables scripts to generate some rules they generally allow computers on the LAN to talk to each other and you would need to setup a forward for if you wanted to NAT the rtorrent program to the WAN nic. You could also setup additional rules by ip address if need be, but again I am kind of guessing at what your trying to do.

dj_farid · l33t Joined: 14 Jun 2004 Posts: 613

Thank you very much!

I am quite sure that I managed to do exactly what I wanted.