I am new in Linux and as I learning Linux route selection process I have a question appeared to me. In case we have two similar routing rules with different source IPs, and both IPs assinged to the host with these rules, how the proper rule is selected? And to exclude the case when application set source IP, let's say I want to use ping utility - how the rule will be choosen in this case?
The source ip is not involved in selecting the route. The route is selected by traversing the routing table: for each entry in the table, compare the network destination prefix (i.e. the network destination AND the netmask) with the destination IP address AND the netmask. If they are equal, we have a match. After trying each entry in the routing table, if there are several matches, choose the entry with the longest prefix. If there is no match, there is no route to the destination. A default route always matches, because the prefix length is zero.
If the destination is not link-local, the matching entry will tell us a gateway address, and the process is repeated for the gateway address. Finally the packet is sent with the source and destination addresses filled in. The original destination address is used, and the source address is taken from the final matching route rule (the
src field in the output of
ip rule has a
priority option. The priority option is the first way the routing table is chosen. A rule with a lower
priority value will be used before a higher one. Calling
ip rule show you will see the rules printed with their priority on the left side.
For the sake of completeness, a quote from
the priority of this rule. PREFERENCE is an unsigned integer value, higher number means lower priority, and rules get processed in order of increasing number. Each rule should have an explicitly set unique priority value. The options preference and order are synonyms with priority.
So first and foremost, it's best to use a unique priority for each rule, then there can be no ambiguity. In the case of rules with the same priority, they will be evaluated in the order they were added. If rules are mutually exclusive this isn't much of a risk (such as two rules that match on different source IPs from other hosts). If your rules are automatically added, that probably means the rule file that is alphabetically first will be used, which isn't a great way to determine routing.
How I reached the conclusion that first added rules are used:
- Created VM (vm1) with two interfaces on the same network (192.168.0.1/24 and 192.168.0.2/24).
- Created another VM (vm2) on the network (192.168.0.3/24)
- Created two routing tables,
ip route add default dev eth0 table table1
ip route add default dev eth1 table table2
- Created two rules with different priorities
ip rule add to 192.168.0.3 table table1 priority 10
ip rule add to 192.168.0.3 table table2 priority 11
- ping vm2 from vm1
tcpdump -i eth0 host 192.168.0.3shows the ping
tcpdump -i eth1 host 192.168.0.3does not
This is the expected behavior of
- Re-add the table2 rule with priority 10, ping still only appears on
ip rule showlists
- Delete table1 rule, ping appears on eth1.
- Re-add table1 rule, ping still on eth1.
ip rule showlists