0

I have an interesting problem that I would like to understand more.

This is my following rules list:

# ip rule show
0:  from all lookup local
32761:  from all to 188.40.122.95 lookup vpn
32762:  from all to 178.63.26.145 lookup vpn
32763:  from all to 176.9.71.146 lookup vpn
32764:  from all to 159.69.66.229 lookup vpn
32765:  from 192.168.100.0/28 lookup vpn
32766:  from all lookup main
32767:  from all lookup default

and this is how it looks like the VPN table

# ip route show table vpn
default dev tun0 scope link
192.168.100.0/28 dev eth0 scope link

If I send a ping to the IP addr 88.40.122.95 the outbound interface is tun0 and this is understandable because in the table vpn we find the default route.

However if I remove the default route the package still find its way and it can go out via the interface eth0.

Why so? I would expect that specifying those rules

32761:  from all to 188.40.122.95 lookup vpn
32762:  from all to 178.63.26.145 lookup vpn
32763:  from all to 176.9.71.146 lookup vpn
32764:  from all to 159.69.66.229 lookup vpn

the packet must respects the rule in the vpn table and if the table does not have any default then it should fail.

The reason of this design is because I would like that the traffic generated for those IPs goes out only and only via the tun0 and if for some reasons the default rule is not found then it must fail.

6
  • What are you trying to do. Edit the question to make clear. Am I correct in thinking you are trying to prevent routes that avoid the VPN? Aug 7 at 21:52
  • exactly I'm trying to have routes that avoid the VPN.
    – Mazzy
    Aug 7 at 21:58
  • 1
    What are you trying to do. Edit the question to make clear. Aug 7 at 21:59
  • I've edited. it should be clearer
    – Mazzy
    Aug 7 at 22:01
  • Aren't you trying to solve a firewall issue with a routing solution? Aug 7 at 23:29
1

However if I remove the default route the package still find its way and it can go out via the interface eth0.

Yes, because there is no longer a match in the vpn table, and ip route goes onto the next lookups.

To avoid that you can use the throw route type at the end of your vpn table, something like:

ip route add throw default table vpn

Then, in the absence of a default route inside the vpn table, the lookup will stop there.

Check the man page for ip-route. There are other types of routes you might find interesting in your case: prohibit, unreachable and blackhole.

5
  • Thanks this is was what I was looking but I've tried and it does not work. I get ➜ ~ ip route show table vpn default dev tun0 scope link 192.168.100.0/28 dev eth0 scope link ➜ ~ ip route add throw default table vpn RTNETLINK answers: File exists This happens because the default entry is already in place so i cannot add another entry
    – Mazzy
    Aug 8 at 7:26
  • 1
    man page: "throw [...] Without policy routing it is equivalent to the absence of the route in the routing table." throw gets the ENETUNREACH only when applied on the last looked up table (usually the main table).
    – A.B
    Aug 8 at 9:22
  • yeah that's true. reading better the man page throw would not work. the problem is that any kind of rule that is added as default won't be added because a default rule already exists
    – Mazzy
    Aug 8 at 9:31
  • 1
    I understood here. I would add two default rules one having different metrics
    – Mazzy
    Aug 8 at 9:33
  • ok I think I've solved.
    – Mazzy
    Aug 8 at 9:48
1

I have added the following rule to the route table

ip route add unreachable default metric 100 table vpn

and this is how it looks like:

➜ ip route show table vpn
default dev tun0 scope link
unreachable default metric 100
192.168.100.0/28 dev eth0 scope link

So when the default route table is present then the traffic can go out but when the default route table is not present then the rule with metric 100 will be matched and so the Internet will be unreachable.

Tested and it works. Thanks to A.B. to point out to man page and also to Eduardo

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.