The external IP address selection is not implemented and difficult to implement in eBPF.

However einat do support ip route table lookup of preferred source with bpf_fib_lookup_external = true (default on Linux kernel>=6.7).

So you can add ip route records with external src address set to balance traffics from different internal networks to different external addresses. Or also utilize ip rule to balance traffics by internal source ports in a static manner.

用kernel >= 6.7 测试成功了，用ip ru add from 192.168.1.100 table 2 的方式，可以改变snat ip ,但是用 ip ru add fwmark 的方式不行,snat后都是同一个ip。 iptables 在mangle表上用-i br-lan 和 -s 192.168.1.100 的方式打上fwmark.

环境
ubuntu 24.04 ,kernel 6.8.0-41-generic
我在e2e.sh 基础上加了下面的内容做基于源端口的测试

ip netns exec router ip addr add 10.0.2.101/24 dev veth_r_s2

ip netns exec router ip r add default dev veth_r_s2 src 10.0.2.100 table 2
ip netns exec router ip r add default dev veth_r_s2 src 10.0.2.101 table 3

ip netns exec router ip ru add sport 8000 table 2
ip netns exec router ip ru add sport 9000 table 3

用的snapsot中的einat-static-x86_64-unknown-linux-musl -c einat.toml
配置文件内容
[defaults]
udp_ranges = ["20000-20020"]
[[interfaces]]
if_name = "veth_r_s2"
nat44 = true
bpf_log_level = 5
bpf_fib_lookup_external = true
[[interfaces.externals]]
match_address = { start = "10.0.2.100", end = "10.0.2.103" }

用
echo ok|nc -u -p 8000 10.0.2.1 8000
echo ok|nc -u -p 9000 10.0.2.1 8000
的方式发包
在server2上抓到来源ip还都是 10.0.2.100

用了ubuntu 24.10 , kernel 6.11.0-8-generic 测试，基于源端口和fwmark还是snat到同一个ip了。

测试脚本:
#!/usr/bin/env bash
set -eux

ip -all netns delete

enable forwarding

ip netns add server1
ip netns add server2
ip netns add router
ip netns add device1
ip netns add device2

ip link add veth_r_s1 netns router type veth peer veth_s1_r netns server1
ip link add veth_r_s2 netns router type veth peer veth_s2_r netns server2

ip link add br-lan netns router type bridge
ip link add veth_r_d1 netns router type veth peer veth_d1_r netns device1
ip link add veth_r_d2 netns router type veth peer veth_d2_r netns device2

server: setup network

ip netns exec server1 ip addr add 10.0.1.1/24 dev veth_s1_r
ip netns exec server1 ip addr add 10.0.1.2/24 dev veth_s1_r
ip netns exec server1 ip link set veth_s1_r up

server2

ip netns exec server2 ip addr add 10.0.2.1/24 dev veth_s2_r
ip netns exec server2 ip addr add 10.0.2.2/24 dev veth_s2_r
ip netns exec server2 ip link set veth_s2_r up

router: setup external networks

ip netns exec router ip addr add 10.0.1.100/24 dev veth_r_s1
ip netns exec router ip addr add 10.0.1.200/24 dev veth_r_s1
ip netns exec router ip link set veth_r_s1 up
ip netns exec router ip addr add 10.0.2.100/24 dev veth_r_s2
ip netns exec router ip link set veth_r_s2 up
ip netns exec router ip route add default dev veth_r_s1 src 10.0.1.100 table 2
ip netns exec router ip route add default dev veth_r_s1 src 10.0.1.200 table 3
ip netns exec router ip ru add sport 8001 table 2
ip netns exec router ip ru add sport 8002 table 3

router: setup LAN

ip netns exec router ip link set veth_r_d1 master br-lan
ip netns exec router ip link set veth_r_d2 master br-lan
ip netns exec router ip addr add 192.168.1.1/24 dev br-lan
ip netns exec router ip link set br-lan up
ip netns exec router ip link set veth_r_d1 up
ip netns exec router ip link set veth_r_d2 up

ip netns exec router sysctl net.ipv4.ip_forward=1
ip netns exec router einat -i veth_r_s1 >/dev/null 2>&1 &
ip netns exec server1 ncat --broker -luv -p 4000 -o /dev/stdout &
sleep 1

device: setup network

ip netns exec device1 ip addr add 192.168.1.100/24 dev veth_d1_r
ip netns exec device1 ip link set veth_d1_r up
ip netns exec device1 ip route add default via 192.168.1.1 dev veth_d1_r

device2

ip netns exec device2 ip addr add 192.168.1.200/24 dev veth_d2_r
ip netns exec device2 ip link set veth_d2_r up
ip netns exec device2 ip route add default via 192.168.1.1 dev veth_d2_r

ip netns exec device1 nc -uq0 -p 8001 10.0.1.1 4000 <<<"test 8001"
ip netns exec device1 nc -uq0 -p 8002 10.0.1.1 4000 <<<"test 8002"
sleep 1

测试结果:
Ncat: Listening on 0.0.0.0:4000
Ncat: Connection from 10.0.1.100:20993.
test 8001
test 8001

• ip netns exec device1 nc -uq0 -p 8002 10.0.1.1 4000
  Ncat: Listening on 0.0.0.0:4000
  Ncat: Connection from 10.0.1.100:29262.
  test 8002
  test 8002
• sleep 1