When working with multi-homed Linux systems (especially in security applications), we frequently encounter two critical requirements:

1. Ensuring responses always egress through the same interface where the request was received
2. Precisely controlling which interface initiates outbound connections

Traditional routing tables don't handle these scenarios well because:

• The kernel's reverse path filtering (rp_filter) may block asymmetric routing
• Default gateway selection follows metric priorities
• Application-level sockets don't inherently know which interface to bind to

This is the most robust approach using iproute2 tools:

# Create separate routing tables
echo "200 eth0_table" >> /etc/iproute2/rt_tables
echo "201 3g_table" >> /etc/iproute2/rt_tables

# Add rules to select routing table based on interface
ip rule add from <eth0_IP> lookup eth0_table
ip rule add from <3g_IP> lookup 3g_table

# Populate the routing tables
ip route add default via <eth0_gw> dev eth0 table eth0_table
ip route add default via <3g_gw> dev 3g table 3g_table

For programmatic control in Python:

import socket

def create_outbound_socket(interface_name):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.setsockopt(socket.SOL_SOCKET, 25, interface_name.encode())
    return s

# Usage:
eth0_socket = create_outbound_socket("eth0")
3g_socket = create_outbound_socket("wwan0")

For stateful reply path control:

# Mark incoming packets
iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -i wwan0 -j MARK --set-mark 2

# Create routing rules for marks
ip rule add fwmark 1 table eth0_table
ip rule add fwmark 2 table 3g_table

Essential diagnostic commands:

# View routing decisions
ip route get <destination_ip>

# Check interface binding
ss -tulpn

# Verify policy routing
ip rule list

• Handle DHCP renewals on both interfaces
• Watch for MTU differences between interfaces
• Consider TCP MSS clamping for 3G links
• Test failover scenarios with interface flapping

When dealing with Linux systems that have multiple active network interfaces (like Ethernet + 3G/4G), routing responses can become problematic. By default, Linux uses the routing table to determine the egress interface for response packets, which might not match the incoming interface - especially when both interfaces have default gateways.

In security monitoring scenarios, we often need:

• Responses to return via the same interface the request arrived on
• Ability to initiate connections through specific interfaces regardless of subnet
• Maintain separate routing domains per interface

The standard Linux routing behavior breaks these requirements.

Network namespaces provide complete isolation of network stacks. Here's how to implement:

# Create namespace for 3G interface
ip netns add 3gnet

# Move 3G interface to namespace
ip link set ppp0 netns 3gnet

# Configure routing in each namespace
ip netns exec 3gnet ip route add default via 192.168.5.1
ip route add default via 10.0.0.1

A more flexible approach without full namespace isolation:

# Create separate routing tables
echo "200 eth0rt" >> /etc/iproute2/rt_tables
echo "201 ppp0rt" >> /etc/iproute2/rt_tables

# Mark packets based on incoming interface
iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -i ppp0 -j MARK --set-mark 2

# Configure policy routing
ip rule add fwmark 1 table eth0rt
ip rule add fwmark 2 table ppp0rt

# Populate routing tables
ip route add default via 10.0.0.1 dev eth0 table eth0rt
ip route add default via 192.168.5.1 dev ppp0 table ppp0rt

To initiate connections through specific interfaces regardless of destination:

# Bind to specific interface using SO_BINDTODEVICE
int fd = socket(AF_INET, SOCK_STREAM, 0);
setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, "eth0", 4);

# Alternative using source address binding
struct sockaddr_in src_addr;
src_addr.sin_family = AF_INET;
src_addr.sin_port = 0; // system chooses port
inet_pton(AF_INET, "10.0.0.100", &src_addr.sin_addr);
bind(fd, (struct sockaddr*)&src_addr, sizeof(src_addr));

In production environments, consider these additional factors:

• Connection state tracking for stateful protocols
• Interface failure detection and failover
• MTU differences between interfaces
• DNS resolution through the correct interface

The complete solution often requires combining several techniques like network namespaces, policy routing, and socket options.