I have an embedded linux system with two network interfaces (lan0, wlan0) that are configured to the same subnet. A server on this system accepts tcp connections on both interfaces.

How I can assure that that all responses for a session are send on the same interface that the request was received on? I.e. how can all traffic of a tcp session be limited to a specific network interface?

The listen() socket and the accepted sockets can be bound to an interface/device with setsockopt(fd, BIND_TO_DEVICE). The server does this for both interfaces. This helps to detect on which interface the session was created and to limit the outbound traffic to the same interface.

But when the accept() happens, the SYN-ACK is send back to the client and a problem seems to be that this initial packet can be send over the other (wrong) interface because of the ARP lookup. The arp can find the ip address of the client on the other/"wrong" interface because the client is also visible there.


1 Answer 1


You can limit the tcp connection for the interface using iptables.

#iptables -A INPUT -p tcp -i eth0 --syn -m limit --limit 1/s --limit-burst 3 -j RETURN

--limit 1/s: Maximum average matching rate in seconds
--limit-burst 3: Maximum initial number of packets to match
  • I don't want to limit the amount of syns per interface, but rather link any traffic from the session to the originating interface.
    – dantje
    Commented Apr 4, 2012 at 14:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .