cloudscaleKnowledge Base

General information

Once you have assigned a Floating IP to your server as described in our Floating IPs and Networks article, the IP is configured locally on a dummy interface (dummy0 or dummy1, depending on the configuration path you chose).

Inbound packets for that IP still arrive on your primary NIC (e.g. enp3s0). The dummy interface simply tells the kernel to treat the address as local. For outbound traffic, Linux follows the weak host model: an address configured on any local interface can be used as a source address on any other interface. The default route on the primary NIC handles the actual forwarding.

Below are the correct commands for making curl and nmap use the Floating IP as the source address.

curl without routing rules

curl can bind to a specific source IP. The kernel will then use the default route on the primary interface to deliver the packet.

curl --interface 192.0.2.123 ifconfig.cc
curl --interface 2001:db8::cafe ifconfig.cc

Important note: Do not use curl --interface dummy0 or curl --interface dummy1. This sets SO_BINDTODEVICE, which pins the packet to the dummy interface. The result varies by system and privilege level—it may fail immediately or appear to work under some configurations—so binding the device name is inherently unreliable.

nmap without routing rules

nmap determines which interface "owns" the source address. Because the Floating IP is configured on the dummy interface, nmap tries to send via that interface and fails to find a route. You must use -e to override this and force the physical interface.

sudo nmap -S 192.0.2.123 -e enp3s0 -Pn -p 25,443,465,587 203.0.113.10

Configuring source-based routing

On a standard server with a single uplink, a separate routing rule is unnecessary: the default route already sends traffic out the primary interface. Source-based routing is only useful if your server has multiple NICs or multiple gateways and you need to force Floating-IP traffic out a specific link.

If you do need it, find your default gateway:

ip route show default
ip -6 route show default

Then add the rule and route (replace the interface and gateway with your values):

sudo ip rule add from 192.0.2.123 lookup 100
sudo ip route add default via 198.51.100.1 dev enp3s0 table 100

sudo ip -6 rule add from 2001:db8::cafe lookup 100
sudo ip -6 route add default via fe80::1 dev enp3s0 table 100

Important note: These routing changes are not permanent and will be lost after a reboot.

curl and nmap with routing rules

For curl, the command stays exactly the same with or without routing rules:

curl --interface 192.0.2.123 ifconfig.cc
curl --interface 2001:db8::cafe ifconfig.cc

For nmap, source-based routing does not change the required flags. nmap reads only the main routing table (/proc/net/route for IPv4, /proc/net/ipv6_route for IPv6) and is not aware of policy rules. It will still try to bind the interface that owns the source address unless you explicitly override it with -e.

sudo nmap -S 192.0.2.123 -e enp3s0 -Pn -p 25,443,465,587 203.0.113.10

Differences at a glance

| | curl | nmap | |-----------------|-----------------------------------|----------------------------------------------------| | Without rules | --interface 192.0.2.123 | -S 192.0.2.123 -e enp3s0 | | With rules | --interface 192.0.2.123 | -S 192.0.2.123 -e enp3s0 (still required) |