Linux: Is there handy way to exec a program binding it to IP-address of choice?
In FreeBSD 4.9 it was very easy to accomplish with just a single command like
jail [-u username] path hostname ip-number command
if path was / you had running just the same program as usual but all its network communication was restricted to use only given IP-address as the source. Sometimes it's very handy.
Now in Linux there's LXC, which does look very similar to FreeBSD's jail (or Solaris' zones) — can you think of similar way to execute a program?
linux freebsd ip lxc jails
asked Sep 13 '14 at 19:45
poigepoige
4,1371544
add a comment |
In FreeBSD 4.9 it was very easy to accomplish with just a single command like
jail [-u username] path hostname ip-number command
if path was / you had running just the same program as usual but all its network communication was restricted to use only given IP-address as the source. Sometimes it's very handy.
Now in Linux there's LXC, which does look very similar to FreeBSD's jail (or Solaris' zones) — can you think of similar way to execute a program?
linux freebsd ip lxc jails
asked Sep 13 '14 at 19:45
poigepoige
4,1371544
What program are you trying to do this with? Many programs are configurable enough that they can be told which IP to bind to.
– Warren Young
Sep 13 '14 at 22:54
@WarrenYoung, Thanks K. O., but "many" != "all"
– poige
Sep 14 '14 at 4:36
A good use case for "jailing" an executable to use a specific IP is running multiple game servers on one machine on a LAN party. E.g. Valve games are only broadcasting on ports 27015-27020 so per IP you can only have 6 servers. So you add virtual IP's on a NIC but then you need to specify "+ip <address>" on the game server's command line which stops broadcasting its presence to clients => no servers visible in LAN browser. So "+ip" won't work. Therefore we need to jail each server in an environment where it can only find 1 IP address. Result: no limit in #servers + clients see all servers.
– Timmos
Jan 17 '17 at 9:15
add a comment |
In FreeBSD 4.9 it was very easy to accomplish with just a single command like
jail [-u username] path hostname ip-number command
if path was / you had running just the same program as usual but all its network communication was restricted to use only given IP-address as the source. Sometimes it's very handy.
Now in Linux there's LXC, which does look very similar to FreeBSD's jail (or Solaris' zones) — can you think of similar way to execute a program?
linux freebsd ip lxc jails
asked Sep 13 '14 at 19:45
poigepoige
4,1371544
In FreeBSD 4.9 it was very easy to accomplish with just a single command like
jail [-u username] path hostname ip-number command
if path was / you had running just the same program as usual but all its network communication was restricted to use only given IP-address as the source. Sometimes it's very handy.
Now in Linux there's LXC, which does look very similar to FreeBSD's jail (or Solaris' zones) — can you think of similar way to execute a program?
linux freebsd ip lxc jails
linux freebsd ip lxc jails
asked Sep 13 '14 at 19:45
poigepoige
4,1371544
asked Sep 13 '14 at 19:45
poigepoige
4,1371544
edited Sep 14 '14 at 4:32
poige
asked Sep 13 '14 at 19:45
poigepoige
4,1371544
asked Sep 13 '14 at 19:45
poigepoige
4,1371544
asked Sep 13 '14 at 19:45
poigepoige
4,1371544
4,1371544
What program are you trying to do this with? Many programs are configurable enough that they can be told which IP to bind to.
– Warren Young
Sep 13 '14 at 22:54
@WarrenYoung, Thanks K. O., but "many" != "all"
– poige
Sep 14 '14 at 4:36
A good use case for "jailing" an executable to use a specific IP is running multiple game servers on one machine on a LAN party. E.g. Valve games are only broadcasting on ports 27015-27020 so per IP you can only have 6 servers. So you add virtual IP's on a NIC but then you need to specify "+ip <address>" on the game server's command line which stops broadcasting its presence to clients => no servers visible in LAN browser. So "+ip" won't work. Therefore we need to jail each server in an environment where it can only find 1 IP address. Result: no limit in #servers + clients see all servers.
– Timmos
Jan 17 '17 at 9:15
add a comment |
What program are you trying to do this with? Many programs are configurable enough that they can be told which IP to bind to.
– Warren Young
Sep 13 '14 at 22:54
@WarrenYoung, Thanks K. O., but "many" != "all"
– poige
Sep 14 '14 at 4:36
A good use case for "jailing" an executable to use a specific IP is running multiple game servers on one machine on a LAN party. E.g. Valve games are only broadcasting on ports 27015-27020 so per IP you can only have 6 servers. So you add virtual IP's on a NIC but then you need to specify "+ip <address>" on the game server's command line which stops broadcasting its presence to clients => no servers visible in LAN browser. So "+ip" won't work. Therefore we need to jail each server in an environment where it can only find 1 IP address. Result: no limit in #servers + clients see all servers.
– Timmos
Jan 17 '17 at 9:15
What program are you trying to do this with? Many programs are configurable enough that they can be told which IP to bind to.
– Warren Young
Sep 13 '14 at 22:54
What program are you trying to do this with? Many programs are configurable enough that they can be told which IP to bind to.
– Warren Young
Sep 13 '14 at 22:54
@WarrenYoung, Thanks K. O., but "many" != "all"
– poige
Sep 14 '14 at 4:36
@WarrenYoung, Thanks K. O., but "many" != "all"
– poige
Sep 14 '14 at 4:36
A good use case for "jailing" an executable to use a specific IP is running multiple game servers on one machine on a LAN party. E.g. Valve games are only broadcasting on ports 27015-27020 so per IP you can only have 6 servers. So you add virtual IP's on a NIC but then you need to specify "+ip <address>" on the game server's command line which stops broadcasting its presence to clients => no servers visible in LAN browser. So "+ip" won't work. Therefore we need to jail each server in an environment where it can only find 1 IP address. Result: no limit in #servers + clients see all servers.
– Timmos
Jan 17 '17 at 9:15
A good use case for "jailing" an executable to use a specific IP is running multiple game servers on one machine on a LAN party. E.g. Valve games are only broadcasting on ports 27015-27020 so per IP you can only have 6 servers. So you add virtual IP's on a NIC but then you need to specify "+ip <address>" on the game server's command line which stops broadcasting its presence to clients => no servers visible in LAN browser. So "+ip" won't work. Therefore we need to jail each server in an environment where it can only find 1 IP address. Result: no limit in #servers + clients see all servers.
– Timmos
Jan 17 '17 at 9:15
add a comment |
1 Answer
1
active
oldest
votes
Starting the process inside a network namespace that can only see the desired IP address can accomplish something similar. For instance, supposed I only wanted localhost available to a particular program.
First, I create the network namespace:
ip netns add limitednet
Namespaces have a loopback interface by default, so next I just need to bring it up:
sudo ip netns exec limitednet ip link set lo up
Now, I can run a program using ip netns exec limitednet and it will only be able to see the loopback interface:
sudo ip netns exec limitednet ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
If I wanted to limit it to an address other than localhost, I could add other interfaces into the namespace using:
ip link set DEVICE_NAME netns NAMESPACE
I'd have to experiment a bit more to figure out how to add a single IP address into a namespace in the case where an interface might have more than one IP address
The LWN article on namespaces is also helpful.
answered Sep 13 '14 at 20:34
Steven DSteven D
32.4k798108
But it's worth mentioning it would require much more preparations since network namespace has its own routing table and so on. If somebody comes with simpler way to mimicjail, I'm gonna use it. ;)
– poige
Sep 13 '14 at 20:47
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f155446%2flinux-is-there-handy-way-to-exec-a-program-binding-it-to-ip-address-of-choice%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Starting the process inside a network namespace that can only see the desired IP address can accomplish something similar. For instance, supposed I only wanted localhost available to a particular program.
First, I create the network namespace:
ip netns add limitednet
Namespaces have a loopback interface by default, so next I just need to bring it up:
sudo ip netns exec limitednet ip link set lo up
Now, I can run a program using ip netns exec limitednet and it will only be able to see the loopback interface:
sudo ip netns exec limitednet ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
If I wanted to limit it to an address other than localhost, I could add other interfaces into the namespace using:
ip link set DEVICE_NAME netns NAMESPACE
I'd have to experiment a bit more to figure out how to add a single IP address into a namespace in the case where an interface might have more than one IP address
The LWN article on namespaces is also helpful.
answered Sep 13 '14 at 20:34
Steven DSteven D
32.4k798108
But it's worth mentioning it would require much more preparations since network namespace has its own routing table and so on. If somebody comes with simpler way to mimicjail, I'm gonna use it. ;)
– poige
Sep 13 '14 at 20:47
add a comment |
Starting the process inside a network namespace that can only see the desired IP address can accomplish something similar. For instance, supposed I only wanted localhost available to a particular program.
First, I create the network namespace:
ip netns add limitednet
Namespaces have a loopback interface by default, so next I just need to bring it up:
sudo ip netns exec limitednet ip link set lo up
Now, I can run a program using ip netns exec limitednet and it will only be able to see the loopback interface:
sudo ip netns exec limitednet ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
If I wanted to limit it to an address other than localhost, I could add other interfaces into the namespace using:
ip link set DEVICE_NAME netns NAMESPACE
I'd have to experiment a bit more to figure out how to add a single IP address into a namespace in the case where an interface might have more than one IP address
The LWN article on namespaces is also helpful.
answered Sep 13 '14 at 20:34
Steven DSteven D
32.4k798108
But it's worth mentioning it would require much more preparations since network namespace has its own routing table and so on. If somebody comes with simpler way to mimicjail, I'm gonna use it. ;)
– poige
Sep 13 '14 at 20:47
add a comment |
Starting the process inside a network namespace that can only see the desired IP address can accomplish something similar. For instance, supposed I only wanted localhost available to a particular program.
First, I create the network namespace:
ip netns add limitednet
Namespaces have a loopback interface by default, so next I just need to bring it up:
sudo ip netns exec limitednet ip link set lo up
Now, I can run a program using ip netns exec limitednet and it will only be able to see the loopback interface:
sudo ip netns exec limitednet ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
If I wanted to limit it to an address other than localhost, I could add other interfaces into the namespace using:
ip link set DEVICE_NAME netns NAMESPACE
I'd have to experiment a bit more to figure out how to add a single IP address into a namespace in the case where an interface might have more than one IP address
The LWN article on namespaces is also helpful.
answered Sep 13 '14 at 20:34
Steven DSteven D
32.4k798108
Starting the process inside a network namespace that can only see the desired IP address can accomplish something similar. For instance, supposed I only wanted localhost available to a particular program.
First, I create the network namespace:
ip netns add limitednet
Namespaces have a loopback interface by default, so next I just need to bring it up:
sudo ip netns exec limitednet ip link set lo up
Now, I can run a program using ip netns exec limitednet and it will only be able to see the loopback interface:
sudo ip netns exec limitednet ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
If I wanted to limit it to an address other than localhost, I could add other interfaces into the namespace using:
ip link set DEVICE_NAME netns NAMESPACE
I'd have to experiment a bit more to figure out how to add a single IP address into a namespace in the case where an interface might have more than one IP address
The LWN article on namespaces is also helpful.
answered Sep 13 '14 at 20:34
Steven DSteven D
32.4k798108
answered Sep 13 '14 at 20:34
Steven DSteven D
32.4k798108
answered Sep 13 '14 at 20:34
Steven DSteven D
32.4k798108
answered Sep 13 '14 at 20:34
Steven DSteven D
32.4k798108
32.4k798108
But it's worth mentioning it would require much more preparations since network namespace has its own routing table and so on. If somebody comes with simpler way to mimicjail, I'm gonna use it. ;)
– poige
Sep 13 '14 at 20:47
add a comment |
But it's worth mentioning it would require much more preparations since network namespace has its own routing table and so on. If somebody comes with simpler way to mimicjail, I'm gonna use it. ;)
– poige
Sep 13 '14 at 20:47
But it's worth mentioning it would require much more preparations since network namespace has its own routing table and so on. If somebody comes with simpler way to mimic
jail, I'm gonna use it. ;)– poige
Sep 13 '14 at 20:47
But it's worth mentioning it would require much more preparations since network namespace has its own routing table and so on. If somebody comes with simpler way to mimic
jail, I'm gonna use it. ;)– poige
Sep 13 '14 at 20:47
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f155446%2flinux-is-there-handy-way-to-exec-a-program-binding-it-to-ip-address-of-choice%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What program are you trying to do this with? Many programs are configurable enough that they can be told which IP to bind to.
– Warren Young
Sep 13 '14 at 22:54
@WarrenYoung, Thanks K. O., but "many" != "all"
– poige
Sep 14 '14 at 4:36
A good use case for "jailing" an executable to use a specific IP is running multiple game servers on one machine on a LAN party. E.g. Valve games are only broadcasting on ports 27015-27020 so per IP you can only have 6 servers. So you add virtual IP's on a NIC but then you need to specify "+ip <address>" on the game server's command line which stops broadcasting its presence to clients => no servers visible in LAN browser. So "+ip" won't work. Therefore we need to jail each server in an environment where it can only find 1 IP address. Result: no limit in #servers + clients see all servers.
– Timmos
Jan 17 '17 at 9:15