Force an application to use a specific network interface

Question

I'm using multiple network interfaces (LAN and Wireless), and I've noticed that there's a way to change the order of prefered interfaces. How can I use the wired network to do work, check email, and so on (securely), and use the wireless VLAN to access other stuff (otherwise blocked by ports and sometimes websense)?

Answer 1

The trick is adjusting the routing tables (which doesn't depend on destination port or source app, but does depend on the destination host). This assumes that you're on Linux or OS X (as the tags show).

Say your default gateway is 1.2.3.4 and you have a vpn which can route traffic on 6.7.8.9. If you want your mail traffic to route over 6.7.8.9, just do

sudo route add mail.myserver.com 6.7.8.9

Some versions of route might require a "gw" keyword between the address and next hop. If you want to make a whole net route over that next hop, just add a netmask in CIDR notation for the destination, like

sudo route add 192.168.0.0/24 6.7.8.9

If you want to view the existing routing table, use

netstat -nrl
or
ip route list

If you're on Windows, "net route" will get you most of the way there, but the syntax is totally different.

Answer 2

Problem is that you're going to have multiple gateways to your network connection, and that's a bit difficult to manage...

Some server or network related unix and linux tools usually have a flag called "interface", where you can tell which interface you wanna use, like in tcpdump, for example:

tcpdump -i eth0

But as I think you are asking about routing standard desktop software, that gets a bit more difficult...

I can tell you a trick for that anyway... My usual fix for dealing with that problems is using a proxy and only having one gateway. Almost any software that uses Internet this days has options for configuring a proxy, so you can do it on any of this ways:

1.- Setting up a proxy on the "unsecured" (an I mean, where the policies are not enforced) part of your network, and pointing your software to that proxy.

2.- Setting a SSH server on another "unsecured" place, say, your home, or a dedicated server you have on the internet, and opening a connection through a special feature that SSH has that creates a socks proxy server:

ssh -D 1234 user@host

That would create on your computer a socks proxy server on port "1234", that would connect to your "host", using your "user", and go to the Internet through the connection that your "host" has... Then, on your local software, you only need to open the proxy configuration tools, and point to localhost:1234.

Nice tricks for avoiding corporate internet policies :P

:D

Answer 3

You will probably need to use the low-level IO control functions (ioctl). In particular:

ioctl( socket, SIOCGIFADDR, ... ); // Get network interface address

and

ioctl( socket, SIOCSIFADDR, ... ); // Set network interface address

See this man page for more details.

Answer 4

Much easier following this tutorial http://www.gebert-hh.de/computer/forcing_all_ip_traffic_through_vpn_on_mac_os