Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have an embedded linux system with two network interfaces (lan0, wlan0) that are configured to the same subnet. A server on this system accepts tcp connections on both interfaces.

How I can assure that that all responses for a session are send on the same interface that the request was received on? I.e. how can all traffic of a tcp session be limited to a specific network interface?

The listen() socket and the accepted sockets can be bound to an interface/device with setsockopt(fd, BIND_TO_DEVICE). The server does this for both interfaces. This helps to detect on which interface the session was created and to limit the outbound traffic to the same interface.

But when the accept() happens, the SYN-ACK is send back to the client and a problem seems to be that this initial packet can be send over the other (wrong) interface because of the ARP lookup. The arp can find the ip address of the client on the other/"wrong" interface because the client is also visible there.

share|improve this question
    
Some research revealed a couple of related posts: stackoverflow.com/questions/172905/… and embedded-bits.co.uk/2008/multiple-network-gotcha. –  dantje Apr 5 '12 at 11:54
add comment

1 Answer

You can limit the tcp connection for the interface using iptables.

#iptables -A INPUT -p tcp -i eth0 --syn -m limit --limit 1/s --limit-burst 3 -j RETURN

--limit 1/s: Maximum average matching rate in seconds
--limit-burst 3: Maximum initial number of packets to match
share|improve this answer
    
I don't want to limit the amount of syns per interface, but rather link any traffic from the session to the originating interface. –  dantje Apr 4 '12 at 14:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.