I am new in Linux and as I learning Linux route selection process I have a question appeared to me. In case we have two similar routing rules with different source IPs, and both IPs assinged to the host with these rules, how the proper rule is selected? And to exclude the case when application set source IP, let's say I want to use ping utility - how the rule will be choosen in this case?


The source ip is not involved in selecting the route. The route is selected by traversing the routing table: for each entry in the table, compare the network destination prefix (i.e. the network destination AND the netmask) with the destination IP address AND the netmask. If they are equal, we have a match. After trying each entry in the routing table, if there are several matches, choose the entry with the longest prefix. If there is no match, there is no route to the destination. A default route always matches, because the prefix length is zero.

If the destination is not link-local, the matching entry will tell us a gateway address, and the process is repeated for the gateway address. Finally the packet is sent with the source and destination addresses filled in. The original destination address is used, and the source address is taken from the final matching route rule (the src field in the output of ip route).

  • Routing based on routing tables is clear for me. But it is said that RPDB rules are evaluated before routing table (f. e.: linux-ip.net/html/routing-selection.html) and my question was about it: how OS will know which routing table it should look into if it will have two rules in RPDB with different source IPs and all other parameters similar, in case where application does not have specific IP binding (f.e. ping or nslookup)?
    – ko4evneg
    Jul 9 '17 at 21:29

ip rule has a priority option. The priority option is the first way the routing table is chosen. A rule with a lower priority value will be used before a higher one. Calling ip rule show you will see the rules printed with their priority on the left side.

[priority]:    [rule]

For the sake of completeness, a quote from man ip-rule:


the priority of this rule. PREFERENCE is an unsigned integer value, higher number means lower priority, and rules get processed in order of increasing number. Each rule should have an explicitly set unique priority value. The options preference and order are synonyms with priority.

Emphasis mine.

So first and foremost, it's best to use a unique priority for each rule, then there can be no ambiguity. In the case of rules with the same priority, they will be evaluated in the order they were added. If rules are mutually exclusive this isn't much of a risk (such as two rules that match on different source IPs from other hosts). If your rules are automatically added, that probably means the rule file that is alphabetically first will be used, which isn't a great way to determine routing.

How I reached the conclusion that first added rules are used:

  1. Created VM (vm1) with two interfaces on the same network ( and
  2. Created another VM (vm2) on the network (
  3. Created two routing tables, table1 and table2 on vm1

ip route add default dev eth0 table table1

ip route add default dev eth1 table table2

  1. Created two rules with different priorities

ip rule add to table table1 priority 10

ip rule add to table table2 priority 11

  1. ping vm2 from vm1
  2. tcpdump -i eth0 host shows the ping
  3. tcpdump -i eth1 host does not

This is the expected behavior of priority

  1. Re-add the table2 rule with priority 10, ping still only appears on eth0. ip rule show lists table1 rule before table2 rule.
  2. Delete table1 rule, ping appears on eth1.
  3. Re-add table1 rule, ping still on eth1. ip rule show lists table2 rule before table1.
  • But if host have on eth0 and IP on eth1, and two rules with the same priority: "from use table1" and "from use table2". What happens when user runs "ping"?
    – ko4evneg
    Jul 12 '17 at 19:28
  • I don't think this answer is correct in general. E.g: if the OP were to ping IIRC it would send the ping from
    – ninjalj
    Jul 13 '17 at 11:39
  • @ninjalj That's because of the default rules/routes that get created when you configure an interface that say if you're trying to reach something on the same subnet use the corresponding interface. In the post example the default rule is being replaced. In the comment the destination is on a different subnet.
    – Centimane
    Jul 13 '17 at 11:49
  • The original question was about selecting an RPDB rule based on the source address. In the case of a locally originated packet, is the source address even chosen at this point? A program can bind() the socket to an address, but how many client programs do that? The next step in choosing a source address (see linux-ip.net/gl/ip-cref/ip-cref-node174.html) is to get it from the matching route (the src parameter). But at this stage we are already done with the RPDB. In other words: the source address is not available when selecting the rule, so it doesn't play any role in rule selection. Jul 13 '17 at 15:18
  • @JohanMyréen That is probably true, the program would have to bind to the address before reaching the rule in question. If it did that, then only one rule would match the source address anyway, so only one rule could be used. Rules specifying from may only apply to incoming IP traffic. I'll see about testing this.
    – Centimane
    Jul 13 '17 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.