1

Assume my Mac Mini (Sierra/High Sierra, doesn't matter) has two defined users: user1 and user2.

The machine has two IPs assigned via Ethernet:

en7: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500  
options=4<VLAN_MTU>     
...
inet 192.168.1.24 netmask 0xffffff00 broadcast 192.168.1.255    
inet 192.168.1.25 netmask 0xffffff00 broadcast 192.168.1.255
...
status: active

Is it possible restricting user1 to 192.168.1.24 and user2 to 192.168.1.25?

i.e, when user1 performs any network actions on the machine, the source IP would be 192.168.1.24.

Both users can be logged in to the machine at the same time via SSH.

UPDATE

So it's possible to perform source IP NAT translation by adding the following rule to pfctl

nat on en0 inet from any to any -> 192.168.1.24

But nat-rules do not support filtering (by specific user) - in contrary to block/pass rules, so I need to keep digging

Improve this question
1
  • I don't know, but I suspect it would involve setting a route to any address to use a particular interface address for each user: route add -host INADDR_ANY -ifa 192.168.1.24 Have a read through superuser.com/questions/756134/… and man route.
    – Heath Raftery
    Commented Jan 30, 2018 at 13:14

1 Answer 1

Reset to default
0

The solution was to implement a Network Kernel Extension that changes the source IP of the socket based on the user ID.

More on NKEs can be found here

Improve this answer
7
  • 1
    Very interesting! Can you tell me how you changed the source ip? just in a bind() call?
    – horseyguy
    Commented Jul 8, 2019 at 14:03
  • @horseyguy yeah
    – Shai
    Commented Jul 8, 2019 at 15:50
  • 1
    wow, and that affects how the packets get routed? cos in my case i have a VPN that has the default route, but i also have another default route (that is overriden by the VPN) -- and i am trying to get packets from one app to go out the non-VPN interface by binding the sockets to the non-VPN ip, but it doesn't appear to work! It does work on windows, but on macos, i get "no route to host" errors. Any suggestions? or might you even share your code? :)
    – horseyguy
    Commented Jul 10, 2019 at 0:17
  • 1
    It's a good question. Hard to determine without actually testing it. You can also use interface filters for this (I think). Can't share code unfortunately. But if you share yours I am willing to have a look
    – Shai
    Commented Jul 10, 2019 at 7:28
  • 1
    @Shai Have you released the source code for this? Would be nice.
    – Jonathan Cross
    Commented Dec 17, 2020 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .