The routing table is used in order of most specific to least specific.
However on linux it's a bit more complicated than you might expect. Firstly there is more than one routing table, and when which routing table is used is dependent on a number of rules.
To get the full picture:
$ ip rule show
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
$ ip route show table local
broadcast 127.0.0.0 dev lo proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo proto kernel scope link src 127.0.0.1
broadcast 192.168.0.0 dev eth0 proto kernel scope link src 192.168.1.27
local 192.168.1.27 dev eth0 proto kernel scope host src 192.168.1.27
broadcast 192.168.1.255 dev eth0 proto kernel scope link src 192.168.1.27
$ ip route show table main
default via 192.168.1.254 dev eth0
192.168.0.0/23 dev eth0 proto kernel scope link src 192.168.1.27
$ ip route show table default
$
The local
table is the special routing table containing high priority control routes for local and broadcast addresses.
The main
table is the normal routing table containing all non-policy routes. This is also the table you get to see if you simply execute ip route show
(or ip ro
for short). I recommend not using the old route
command anymore, as it only shows the main
table and its output format is somewhat archaic.
The table default
is empty and reserved for post-processing if previous default rules did not select the packet.
You can add your own tables and add rules to use those in specific cases. One example is if you have two internet connections, but one host or subnet must always be routed via one particular internet connection.
The Policy Routing with Linux book explains all this in exquisite detail.