Re: What's the right way to use a *large* number of source addresses?

[nisse@southpole.se (Niels Möller)]

Florian Westphal <fw@strlen.de> writes:

> Niels Möller <nisse@southpole.se> wrote:

>> 3. Just set the desired local address with the bind call. Currently,
>>    this gives an EADDRNOTAVAIL error, so the first step would be some
>>    option to allow arbitrary source addresses.
>
> See 'Making non-local sockets work' in Documentation/networking/tproxy.txt

Great! Sounds like it should work fine with no additional kernel hacking.

Lukas Tribus <luky-37@hotmail.com> writes:

> Yes, its a simple as setting IP_FREEBIND and then binding to the specific
> source IP.
>
> setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one))

This sounds even easier, but I'm not sure it works. For my first test, I just tried

  sysctl net.ipv4.ip_nonlocal_bind=1

(which is the global equivalent of IP_FREEBIND). Then bind succeeds, but
connect fails with EINVAL,

  socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
  bind(3, {sa_family=AF_INET, sin_port=htons(8000), sin_addr=inet_addr("10.200.0.1")}, 16) = 0
  connect(3, {sa_family=AF_INET, sin_port=htons(9), sin_addr=inet_addr("10.1.0.2")}, 16) = -1 EINVAL (Invalid argument)

I'll do some more experiments, using IP_TRANSPARENT, and setting up the
suggested iptables rules.

Thanks,
/Niels