diff --git a/sysdep/unix/io.c b/sysdep/unix/io.c
index ba2e1661..0dcec17e 100644
--- a/sysdep/unix/io.c
+++ b/sysdep/unix/io.c
@@ -943,8 +943,11 @@ sock_new(pool *p)
   return s;
 }
 
+/**
+ * sk_setup_common - things to initialize for every socket
+ */
 static int
-sk_setup(sock *s)
+sk_setup_common(sock *s)
 {
   int y = 1;
   int fd = s->fd;
@@ -971,18 +974,6 @@ sk_setup(sock *s)
   }
 #endif
 
-  if (s->vrf && !s->iface)
-  {
-    /* Bind socket to associated VRF interface.
-       This is Linux-specific, but so is SO_BINDTODEVICE. */
-#ifdef SO_BINDTODEVICE
-    struct ifreq ifr = {};
-    strcpy(ifr.ifr_name, s->vrf->name);
-    if (setsockopt(s->fd, SOL_SOCKET, SO_BINDTODEVICE, &ifr, sizeof(ifr)) < 0)
-      ERR("SO_BINDTODEVICE");
-#endif
-  }
-
   if (s->iface)
   {
 #ifdef SO_BINDTODEVICE
@@ -1060,6 +1051,45 @@ sk_setup(sock *s)
   return 0;
 }
 
+/**
+ * sk_setup_accepted - initialize sockets for accepted connections
+ */
+static int
+sk_setup_accepted(sock *s)
+{
+  if (sk_setup_common(s) < 0)
+    return -1;
+
+  return 0;
+}
+
+/**
+ * sk_setup - initialize all other sockets (not for accepted connections)
+ */
+static int
+sk_setup(sock *s)
+{
+  int y = 1;
+  int fd = s->fd;
+
+  if (sk_setup_common(s) < 0)
+    return -1;
+
+  if (s->vrf && !s->iface)
+  {
+    /* Bind socket to associated VRF interface.
+       This is Linux-specific, but so is SO_BINDTODEVICE. */
+#ifdef SO_BINDTODEVICE
+    struct ifreq ifr = {};
+    strcpy(ifr.ifr_name, s->vrf->name);
+    if (setsockopt(s->fd, SOL_SOCKET, SO_BINDTODEVICE, &ifr, sizeof(ifr)) < 0)
+      ERR("SO_BINDTODEVICE");
+#endif
+  }
+
+  return 0;
+}
+
 static void
 sk_insert(sock *s)
 {
@@ -1135,7 +1165,7 @@ sk_passive_connected(sock *s, int type)
       log(L_WARN "SOCK: Cannot get remote IP address for TCP<");
   }
 
-  if (sk_setup(t) < 0)
+  if (sk_setup_accepted(t) < 0)
   {
     /* FIXME: Call err_hook instead ? */
     log(L_ERR "SOCK: Incoming connection: %s%#m", t->err);