Floating IP source address

May 12, 2016 410 views
Networking DigitalOcean DNS System Tools

I am forwarding dns queries onto another external dns server. I would like the queries to appear as they're coming from the floating ip, not the public ip address of my droplet. Any ideas on how to force outgoing traffic through the floating ip address?

1 Answer

Assuming you are using Bind9 as your forwarding DNS server, setting the transfer-source and the query-source to the Droplet's "anchor IP" should cause outgoing traffic to come from your Floating IP.

From How To Use Floating IPs on DigitalOcean:

An anchor IP is only accessible to the Droplet that it belongs to, and to a Floating IP that is assigned to the Droplet. The implication of this is that the anchor IP is where you should bind any public services that you want to make highly available through a Floating IP. For example, if you are using a Floating IP in an active/passive load balancer setup, you should bind your load balancer services to their respective Droplet anchor IPs so they can only be accessed via the Floating IP address. This will prevent your users from using the public IP addresses of your Droplets to bypass your Floating IP.

You can find it using:

  • ip addr show eth0

The "anchor IP" (highlighted) will be under your normal public IP address information:

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 04:01:19:f7:52:01 brd ff:ff:ff:ff:ff:ff
    inet brd scope global eth0
       valid_lft forever preferred_lft forever
    inet scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::601:19ff:fef7:5201/64 scope link 
       valid_lft forever preferred_lft forever

Or you could find it via the metadata service. It will be returned if you query:

  • curl -s

So the options section of your Bind9 configuration should have a section that looks like:


For more info on Bind's usage of addresses and ports, this excerpt of O'Reilly's DNS & Bind is helpful.

A DigitalOcean Floating IP is a publicly-accessible static IP address that can be mapped to one of your Droplets. A Floating IP can also be instantly remapped, via the DigitalOcean Control Panel or API, to one of your other Droplets in the same datacenter. This instant remapping capability grants you the ability to design and create High Availability (HA) server infrastructures by adding redundancy to the entry point, or gateway, to your servers.
Have another answer? Share your knowledge.