What's the meaning of these ip route rules

Question

There are some IP route rules in an old code, but I don't know the meaning of them:

ip route flush table 100
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100

Answer 1

One line at time:

ip route flush table 100

should clear table with ID 100.

ip rule add fwmark 1 lookup 100

adds a rule to packets marked as 1 (I suppose with a --set-mark 1 in iptables) to be referenced with table 100. More on ip rule documentation.

ip route add local 0.0.0.0/0 dev lo table 100

routes all the traffic (0.0.0.0/0 is equivalent to default) to the device lo, i.e. the local loopback, a therm in which the local system is called.

It is not mandatory to the table ID to be an integer (100 in your example), it could be a string too. Here an interesting example.

Answer 2

This code is most certainly part of the setup on Linux for transparent proxy (using iptables' socket match and TPROXY target or nftables's socket expression and tproxy statement).

from Linux kernel's documentation tproxy.txt:

1. Making non-local sockets work
================================

The idea is that you identify packets with destination address matching a local
socket on your box, set the packet mark to a certain value:

# iptables -t mangle -N DIVERT
# iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
# iptables -t mangle -A DIVERT -j MARK --set-mark 1
# iptables -t mangle -A DIVERT -j ACCEPT

Alternatively you can do this in nft with the following commands:

# nft add table filter
# nft add chain filter divert "{ type filter hook prerouting priority -150; }"
# nft add rule filter divert meta l4proto tcp socket transparent 1 meta mark set 1 accept

And then match on that value using policy routing to have those packets
delivered locally:

# ip rule add fwmark 1 lookup 100
# ip route add local 0.0.0.0/0 dev lo table 100

the first command selects an alternate routing table for marked packets. The second command adds content to this routing table: intercept packets (that should have been routed but were diverted) to end on the local system.

This first part, above, is to keep state: connections that were diverted (by the part below) will keep being diverted, because the destination address, which isn't a native host address, will nevertheless exist on a local socket, enabled by the socket option IP_TRANSPARENT:

Note that for this to work you'll have to modify the proxy to enable (SOL_IP,
IP_TRANSPARENT) for the listening socket.

There has to be a dedicated application handling this. For example squid or haproxy with adequate configuration matching the following tproxy rules:

The 'TPROXY' target provides similar functionality without relying on NAT. Simply
add rules like this to the iptables ruleset above:

# iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY \
  --tproxy-mark 0x1/0x1 --on-port 50080

Or the following rule to nft:

# nft add rule filter divert tcp dport 80 tproxy to :50080 meta mark set 1 accept