Configure APT to use a specific IP address or network interface

Question

I have a situation where a server has two IP addresses, both assigned to the same interface. How can I tell APT to use a specific IP to download packages and update caches?

Basically I'm looking for something like --interface in curl(1), only for APT.

     --interface <name>

          Perform an  operation using a specified  interface. You
          can enter interface  name, IP address or  host name...

I've looked into apt.conf(5) and apt-transport-http(1) and found no options there.

I have in mind two workarounds:

1. Setup a proxy that is aware of different interfaces/IPs, and use Acquire::http::Proxy to tell APT to go through that.

2. Perhaps I can setup some network namespaces to achieve this, although I've yet to dive into the docs.

Is it possible for APT to use a specific network interface/IP address? If not, what would be a better workaround?

Here's the specifics of the situation:

A server is assigned two IP addresses, each of which is behind a NAT to the Internet. (The bridge here is only for ease of configuration management, and actually only enp1s0 is behind br0.)

$ ip address show br0
9. br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.2/22 brd 192.168.3.255 scope global dynamic br0
       valid_lft 1055sec preferred_lft 1055sec
    inet 192.168.0.3/22 brd 192.168.3.255 scope global secondary br0
       valid_lft forever preferred_lft forever
    inet6 fe80::5867:78ff:fef8:7146/64 scope link 
       valid_lft forever preferred_lft forever

The two IPs are NAT'ed behind different public IPs. One of them (192.168.0.3) has a high bandwidth to the Internet and is desired for downloading APT packages. However, almost all the other network connections should go through the other IP, and so it (192.168.0.2) is set in the default route.

The desired effect is for APT to use 192.168.0.3 to download packages and caches.

Answer 1

Provided that you have more than one interface that can route towards the update servers, what you need to make sure a route is chosen towards a given set of IP addresses (your update servers) is Policy Routing.

Here's a blog post that discusses something that I think is similar to what you need: https://osric.com/chris/accidental-developer/2019/03/linux-policy-based-routing/