There are some IP route rules in an old code, but I don't know the meaning of them:

ip route flush table 100
ip rule add fwmark 1 lookup 100
ip route add local dev lo table 100
  • 1
    Hello DerekChen. You've seen man ip - did you notice that the subcommands are detailed at the end of the document under the SEE ALSO section? Specifically,man ip-route and man ip-rule
    – roaima
    Dec 30, 2020 at 11:23

2 Answers 2


One line at time:

ip route flush table 100

should clear table with ID 100.

ip rule add fwmark 1 lookup 100

adds a rule to packets marked as 1 (I suppose with a --set-mark 1 in iptables) to be referenced with table 100. More on ip rule documentation.

ip route add local dev lo table 100

routes all the traffic ( is equivalent to default) to the device lo, i.e. the local loopback, a therm in which the local system is called.

It is not mandatory to the table ID to be an integer (100 in your example), it could be a string too. Here an interesting example.


This code is most certainly part of the setup on Linux for transparent proxy (using iptables' socket match and TPROXY target or nftables's socket expression and tproxy statement).

from Linux kernel's documentation tproxy.txt:

1. Making non-local sockets work

The idea is that you identify packets with destination address matching a local
socket on your box, set the packet mark to a certain value:

# iptables -t mangle -N DIVERT
# iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
# iptables -t mangle -A DIVERT -j MARK --set-mark 1
# iptables -t mangle -A DIVERT -j ACCEPT

Alternatively you can do this in nft with the following commands:

# nft add table filter
# nft add chain filter divert "{ type filter hook prerouting priority -150; }"
# nft add rule filter divert meta l4proto tcp socket transparent 1 meta mark set 1 accept

And then match on that value using policy routing to have those packets
delivered locally:

# ip rule add fwmark 1 lookup 100
# ip route add local dev lo table 100

the first command selects an alternate routing table for marked packets. The second command adds content to this routing table: intercept packets (that should have been routed but were diverted) to end on the local system.

This first part, above, is to keep state: connections that were diverted (by the part below) will keep being diverted, because the destination address, which isn't a native host address, will nevertheless exist on a local socket, enabled by the socket option IP_TRANSPARENT:

Note that for this to work you'll have to modify the proxy to enable (SOL_IP,
IP_TRANSPARENT) for the listening socket.

There has to be a dedicated application handling this. For example squid or haproxy with adequate configuration matching the following tproxy rules:

The 'TPROXY' target provides similar functionality without relying on NAT. Simply
add rules like this to the iptables ruleset above:

# iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY \
  --tproxy-mark 0x1/0x1 --on-port 50080

Or the following rule to nft:

# nft add rule filter divert tcp dport 80 tproxy to :50080 meta mark set 1 accept

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.