TAPIF=tap0; BR=br0; LOCAL_IP=192.whatever; MASK=24; REAL_IP=eth0 sudo ip tuntap add dev $TAPIF mode tap user $(whoami) sudo ip addr add $LOCAL_IP/$

TAPIF=tap0; BR=br0; LOCAL_IP=192.whatever; MASK=24; REAL_IP=eth0 sudo ip tuntap add dev $TAPIF mode tap user $(whoami) sudo ip addr add $LOCAL_IP/$MASK dev $TAPIF sudo ip link set $TAPIF up sudo ip link add $BR type bridge sudo ip link set $TAPIF master $BR sudo ip link set $REAL_IF up sudo ip link set $REAL_IF master $BR Means you don't have to add iptables rules to get the kernel tcp/ip stack to ignore packets meant for your program specific user level stack. Raw sockets require special permissions. sudo setcap cap_net_admin,cap_net_raw=eip my_prog_bin ping needs this, for example. getcap $(which ping) /bin/ping = cap_net_raw+ep But this underscores the real issue we face because enough people won't care about your security if its convenient for their programming that it isn't a barrier to acceptance. You have to get the kernel to do things, probably using root privs, to get out of the way of your programs ip traffic now. The kernel will jump in and reject a syn or synack response meant for your program and its user level stack. You don't have do anything like that if your program calls socket() to get an fd and goes on in the usual manner from there.