I'm trying to learn how packet routing works on a linux-based router (OpenWRT in my case) a bit better for setting up a few projects/just-learning. Referencing the below chart, I'll break this into two questions

  1. I'm wondering what (like a process, some other type of routing table, or something I can edit maybe?) is specifically responsible, outside of iptables, for making/directing the "Routing Decisions" in the nodes below. Note, I'm talking about the actual nodes labeled "Routing Decision" in the below picture, not the iptables. IE after a packet makes it through the nat PREROUTING, something has to tell the packet weather to next go to the input filter chain towards a local process, or go to the forward chains, right? For both parts of this question I'd say we can just stick to the top most "Routing Decision" node since I would guess the lower nodes encompass many more possibilities and processes.
  2. Also/or, how is the decision made? Is it as simple as, if the incoming packet is destined for the interface ip it came in on ( from the LAN connection for example), then it should go into this machine itself and send it through the input tables, otherwise it should get forwarded to another interface for going to the external network (just the internet in this case), so forward it to any other interface accepting forwarding. Or, are there other possible ways a packet could be directed into the router, to be handled by some process like a DNS server or something, instead of being directly forwarded to an internet-connected interface.

enter image description here


Whether or not an incoming packet should be routed to the local system is simply dependent on whether the destination IP address is one of the IP addresses on any interface of the local system. Note that it doesn't really matter on what interface a packet comes in; you can have an eth0 interface with IP address, and an extra IP address on the lo interface: packets with destination address arriving on eth0 will be processed locally.

The routing decision is made according to the IP routing tables in conjunction with the IP routing rule tables. These tables are for a part automatically filled when IP addresses are set on interfaces.

You can view the routing rules with the ip rule show command (which can be abbreviated):

$ ip ru sh
    0:  from all lookup local 
32766:  from all lookup main 
32767:  from all lookup default 

You can inspect each of these routing tables with the ip route show table xxx command (can also be abbreviated). The local table concerns packets that should go to the local system:

$ ip ro sh table local
broadcast dev lo  proto kernel  scope link  src 
local dev lo  proto kernel  scope host  src 
local dev lo  proto kernel  scope host  src 
broadcast dev lo  proto kernel  scope link  src 
broadcast dev eth0  proto kernel  scope link  src 
local dev eth0  proto kernel  scope host  src 
broadcast dev eth0  proto kernel  scope link  src 

The main table is what you usually get to see when you e.g. use route (which is deprecated, just like ifconfig), so you don't have to specify its name:

$ ip ro sh
default via dev eth0 dev eth0  proto kernel  scope link  src 

The default table is usually empty, but can be used to hold default routes e.g. if you have multiple gateways.

For more information read the Policy Routing book

| improve this answer | |
  • This is exactly the answer I was looking for. The reference you gave also looks like a great central source being able to research these questions better on my own in the future. – JJBrown Apr 1 '15 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.