Send outbound traffic over floating IP

Posted January 25, 2018 25.1k views
NetworkingUbuntu 16.04

Is it possible to route outbound traffic from a droplet through its floating IP. I.e., make http requests from the droplet that appear to originate from the floating IP?

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Submit an Answer
7 answers

The short answer is yes. The longer answer is that it depends on the software you are using to make the request. It needs to expose some way of binding to a particular interface. If it does, you’ll need to find what we call the “anchor IP” and use it. The easiest way to find the anchor IP is to inspect your Droplet’s metadata. From the Droplet, run:

  • curl -s

In my case, it returns If you wanted to make your request with curl you could then use:

  • curl --interface

Or with wget you would use:

  • wget --bind-address=

In both cases, would now see the request as coming from my Floating IP not my Droplet’s IP address.

Check out this tutorial for more info on Floating IPs: How To Use Floating IPs on DigitalOcean In particular, see the section on “Droplet Anchor IPs.”

The following worked for me on ubuntu:

Find the IPv4 gateway anchor:

curl -s | xargs route add default gw

If you’re concerned about copy / pasting random things (and you should be); the Floating IP gateway documentation can be found here:

Step 1. Run this command to get the gateway for the floating IP

curl -s

Step 2. Run this command to make all outgoing connections appear to come from your floating IP, where $gatewayip$ is the ip obtained from the previous command:

route add default gw $gatewayip$

Someone could make a script to automate that in one shot.

  • I tried this but this killed all network activity to and from the droplet.
    I then ran

    route add default gw NON-FLOATING IP

    Whilst this fixed networking again I then realised the IP I just added was still listed and the non-floating IP was listed twice so I ran this 3 times to remove all entries:

    route del default gw NON-FLOATING IP/FLOATING IP

    Then added it again with:

    route add default gw NON-FLOTING IP

    Now I am back to where I started though and cannot get Ubuntu to use the floating IP for SMTP as attempting to bind to that address causes AMAVIS to block the outgoing messages.

  • That command returns the anchor ip address not the gateway. You need to run the following to get the gateway:

    curl -s
    • Thanks I thought there might have been something wrong with the instructions above. Your command worked and I was also able to get the netmask that way too.

      However whatever I do, outbound connections from my Ubuntu server always show the droplet IP and not the floating IP. If I can’t direct outbound traffic through the floating IP then it seems to be of little value for redundancy/resilience/maintenance as whilst I can set incoming connections to the floating IP, as outbound connections have a different source IP things like mail servers don’t work as get blacklisted.

      I set the DNS of about 30 domains to the floating IP with the idea I could quickly swap these if I needed to switch to a backup server (without doing 1 by 1 from the DO control panel) but maybe I am misunderstanding what floating IPs are for?

      • On a droplet you should have 2 IP addresses. The instance IP and the anchor IP. The default gateway is set to the gateway on the instance IP network.

        I was able to follow these steps to direct outbound traffic through the floating IP:

        1. Get the Anchor IP gateway:

          curl -s
        2. Set the default gateway to the Anchor IP gateway:

          route add default gw <ANCHOR IP GATEWAY>
        3. Remove the instance IP gateway:

          route del default gw <INSTANCE IP GATEWAY>

        Check outbound IP address (this should return your Floating IP):

        • Thanks for the reply Eric but I still can’t get it to report the IP as anything other than the instance IP. Posting IPs as set up a test droplet and have deleted it again.
          Instance IP:
          Floating IP:

          Running the check currently shows the 159 address as expected:

          curl -4 =

          I then run the command to get the gateway IP:

          curl -s =

          I then add a new default gateway using this address:

          sudo route add default gw

          I then try to remove the other existing default gateway and get an error

          sudo route del default gw = SIOCDELRT: No such process

          This is what route displays (after the successful add command):

          root@rwshostingtest:~# route
          Kernel IP routing table
          Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
          default         _gateway         UG    0      0        0 ens3
          default         _gateway         UG    0      0        0 ens3
     U     0      0        0 ens3
       _gateway     UG    0      0        0 ens3
     U     0      0        0 ens4
     UG    0      0        0 ens4
   U     0      0        0 ens3

          The curl command still returns the other IP:

          curl -4 =

          So still can’t get this to work

          This command was a success:

          ip route del

          But then ip route still lists the instance IP.

          • Ok I’ve worked it out at last and got it working.

            First you need to get the gateway IP

            curl -s

            Then add this as a new default gateway:

            route add default gw <ANCHOR IP GATEWAY>

            Then run route -n to see the networks:

            route -n

            This displays the routing table:

           UG    0      0        0 ens3                                                                                                                                      UG    0      0        0 ens3                                                                                                                                  U     0      0        0 ens3                                                                                                                                  UG    0      0        0 ens3                                                                                                                                  U     0      0        0 ens4                                                                                                                                  UG    0      0        0 ens4

            From this I can then work out the command I need to run to delete this second line:

            route del -net gw netmask dev ens3

            Now the curl command shows the floating IP:

            root@rwshostingtest:~# curl -4                                                                                                                                                              

            I think this demonstrates working with floating IPs could do to be a bit easier on DO (so this was handled in the control panel) or at least documented how to switch. Also if I was to need to quickly change the IP for failover I think I would still have to follow these steps or something similar.

          • Your posted reply below does not work for me unfortunately, after I run the commands the droplet cannot connect to the public internet. I’m on Ubuntu 18.04, do you know what has changed since then and how I can send outbound traffic through the floating IP?

Hi, running route add default gw ip-number kills the current ssh connection and afterwards, it seems I am unable to log in again.

@ComputerUser I was on 18.10 I believe when I was trying this. However as I could not get system services to use the floating IP I gave up on it and switched back to the main IP.
It would have saved so much time not having to update DNS on a load of domains and just switch the floating IP between servers but when your email is being received on the floating IP but sent out on the main IP this does not work and leads to the mail server being blacklisted. DO did agree it was too difficult to work with floating IPs and recommended giving up on them until they worked better (e.g. so the server saw it as the primary IP ).
Floating IPs could be a great feature for disaster recovery features (i.e. switch the IP from one server to another without having to edit a load of DNS entries and wait for the cache to update) but it seems they are not there yet.

It’s crazy that I would think this would be such an essential, important feature of floating ips and yet it’s nearly impossible. After fighting this for about 2 or 3 ours on Ubuntu (Tried pretty much everything here, I could not get it to work).

What I ended up doing is using Squid proxy to handle this. If anyone is interested, here’s a bash script to setup Squid locally (with authentication) and have it route traffic through the floating IP (the line with tcp_outgoing_address $GATEWAY ev is basically where the magic happens).

Hopefully DO can shed some light on how to do this properly soon.

  • Floating IPs were really only designed for inbound traffic, not outbound traffic, so none of these solutions are actively supported by our teams. They could break in the future because this isn’t an official feature we support.

    Right now, the best workaround to have outbound traffic go through a floating IP would be to set up some special routing rules, like so:

    ip neigh add $ANCHOR_GW lladdr $L3_MAC dev eth0
    ip neigh #This command is to verify that the route exists
    ip route del default #this command will break your Droplets networking temporarily until you run the next one
    ip route add default via $ANCHOR_GW
    ip route #you would run this command to confirm that you have routing through your anchor IP address.

    Here, you’d replace the address with your anchor gateway you’d get by running the following command on your Droplet:

    curl -s

    Again, this is not a supported feature, so doing this is entirely at your own risk. It may break in the future, and we don’t recommend this sort of setup.

    • @eris this was asked more than a year ago, and I wonder if this is still the case.

      We are considering migrating our infrastructure to DO but we have at least 5 providers that have ip access lists. We have to specify an IP address that they have to add to their auth system.

      As per your comment, this seems to be currently the only way and even so is not recommended or could change.

      We don’t want to bet our infrastructure on something that could change at anytime.

      So I have to ask, is your suggestion still the best way to have a unified outbound ip? We would have N droplets, all of them should exit from the same ip.