direct_fixed

This escaper sends traffic to the target upstream directly from the local host.

The following interfaces are supported:

• tcp connect

• udp relay

• udp connect

• http(s) forward

• ftp over http

The following egress path selection value is supported:

• number id

  The selected node ID is used to choose the bind IP address from bind_ip.

The following common keys are supported:

• shared_logger

• resolver, required

• resolve_strategy

  The user custom resolve strategy will be taken into account.

• tcp_sock_speed_limit

• udp_sock_speed_limit

• udp_socket_buffer

• bind_interface

• no_ipv4

• no_ipv6

• tcp_connect

  The user tcp connect params will be taken into account.

• happy eyeballs

• tcp_misc_opts

• udp_misc_opts

• extra_metrics_tags

bind_ip

optional, type: ip addr str | seq

Set the bind ip address(es) for sockets.

For seq value, each of its element must be ip addr str. Only random selection is supported. Use a route escaper if you need more control.

IPv4 and IPv6 addresses are kept in separate internal lists. If you disable one address family, entries from that family become unusable.

default: not set

bind_foreign

optional, type: bool

Set to true to bind to the same foreign IP address as the client. This is useful with Linux TPROXY.

default: false

Added in version 1.13.0.

bind_foreign_port

optional, type: bool

Set to true if you also want to bind to the same foreign port when bind_foreign is also enabled.

Note

This may cause EADDRINUSE if two connections use the same client address.

Added in version 1.13.0.

default: false

egress_network_filter

optional, type: egress network acl rule

Set the network filter for the resolved remote IP address.

default: all permitted except for loop-back and link-local addresses

tcp_keepalive

optional, type: tcp keepalive

Configure TCP keepalive.

User-level TCP keepalive settings are also applied.

default: no keepalive set

resolve_redirection

optional, type: resolve redirection

Set DNS redirection rules at the escaper level.

default: not set

enable_path_selection

optional, type: bool

Enable path selection.

Note

Path selection must also be enabled on the server side, or this option has no effect.

When enabled, the number id value is interpreted as the 1-based index of the chosen bind address within the family-specific bind list.

default: false

Example:

- name: direct-egress
  type: direct_fixed
  resolver: local-dns
  bind_ip:
    - 192.0.2.10
    - 192.0.2.11
    - 2001:db8::10
  enable_path_selection: true

use_proxy_protocol

optional, type: proxy protocol version

Set the PROXY protocol version to use for outgoing TCP connections, except FTP data connections.

default: not set, which means PROXY protocol won’t be used

Added in version 1.11.3.