I have a PC with two interfaces: eth0(IP address and eth2(IP address In addition, I have a host route in this PC in main table which says that if destination address is, then use eth0 interface.

Now when I send ICMP "echo request" from to interface), then ICMP "echo reply" is sent out from eth0(I have RPF disabled) using as a source IP. This all is as expected because of this host route.

However, when I add an ip rule with selector from and action lookup test right after rule number 0 and table test contains simply a default route using eth2 interface, then ICMP "echo reply" is sent out from eth2 interface.

I'm confused how can this from selector match. When in the day of a life of an ICMP "echo reply" message the source IP was so that match occurred?


The selector from match because echo reply are issued from this address. However in that case it is not the recommended way to proceed. Because from can apply to whatever goes to other interface than eth0 making a bad route in that case. You should use to in your ip rule instead.

The thing matching source address is related to the fact that using ip rule make the routing decision related to a dedicated lookup table make the packet ignore the src default address specified by the route from this interface, like the one you will see in ip route list table local

What happen is in the red part on this diagram : kernel packet travelling diagram

With no ip rule the packet arrive in you machine for local process, and because of the default route the reply come from eth0 (obviously with eth0 IP address). Because of ip rule add from table test routing process change lookup table and do not use default IP address from the interface holding the route to the destination, so it now use the IP address from the replying interface.


According to the Policy Routing Using Linux book, packets sourced from the local machine destined to external systems will enter the routing policy database after going through the output chains, and this is where your from selector will match the outbound echo reply packet from destined to

packet traversal

From http://www.policyrouting.org/PolicyRoutingBook/ONLINE/CH03.web.html:

Consider the path for an externally sourced packet destined for an internal service. It enters the system and is processed by the entrance packet mangling and tagging stage, Pre-Route(1). This stage is where you would apply packet mangling operations such as fwmark and TOS/QoS tagging or perhaps the NetFilter NAT. The packet then enters the RPDB to obtain routing and is routed to the Input(2) chain. The Input chain provides the firewalling functions for packets destined to the Local Machine services.

The reverse scenario is the packet path for an internal service sourced packet destined for an external system, such as the reply packet to the one described in the previous paragraph. It exits the Local Machine and enters the Output(4) chains, which provides the firewalling functions. It then enters the RPDB for route processing and exits the system via the exit packet mangling and tagging stage, Post-Route(5).

  • the schema is about Netfilter. but the problem that the poster encounter is about iproute2 traffic decision. in my mind it is not related. – dominix Jun 9 '17 at 19:32
  • The poster was confused why that specific selector would match in his case. The intention was that this schema would help illustrate that the routing function is entered in different places in the packet path, depending on if the packet is intended for the local machine, or if it's a transversal packet. – user234931 Jun 9 '17 at 20:27
  • But in the given example by the poster, whether it goes to any given address, the packet is never a traversal packet. it is always an incoming packet. incoming is for local machine whatever the ip address is or whatever interface is invoked. So the routing process invoked is the same in both case with or without ip rule. (in my understanding) – dominix Jun 11 '17 at 8:14
  • @dominix That's correct. It was just my assumption that the poster thought the routing process was invoked earlier in the packet path (as if it were a transversal packet), which could explain his confusion. Hence my focus on highlighting that the routing process is invoked in different places for transversal- and local packets. – user234931 Jun 11 '17 at 10:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.