egresso

Rotates your outbound IPv4 and IPv6 source addresses from a prefix pool via BPF - no application configuration necessary.

Super lightweight and fast.

Successor to http-proxy-ipv6-pool-docker.

Setup

The prefix must either already be routed to you or you can use NDP proxying but I don't recommend it.

Use sysctl -w net.ipv4.ip_nonlocal_bind=1 (and the ipv6 equivalent) to allow binding to any address.

ip -6 route add local 2001:db8::/48 dev eth0
ip -4 route add local 192.0.2.0/24 dev eth0

Config

The container you're rotating has to be in host mode (--network host) because it wont work behind Docker's NAT.

network_mode: host
labels:
  egresso.prefixes: "2001:db8::/48,192.0.2.0/24"

You can have up to 16 prefixes which get load balanced evenly within the address family, i.e. if you have a /48 and a /40 of ipv6, 50% of ipv6 connections go to each.

Optional: egresso.host-fallback: "true" falls back to the default host address if the pool has no prefix for that family (default: false).

Docker

Docker images are available:

• GitHub CR
• Codeberg CR

docker run -d --name egresso --restart unless-stopped \
  --privileged --cgroupns=host --pid=host \
  -v /sys/fs/cgroup:/sys/fs/cgroup \
  -v /var/run/docker.sock:/var/run/docker.sock \
  ghcr.io/vojkovic/egresso:latest