Routes and paths

ip rule

Also policy routing, policy-based routing, PBR, routing tables, table, iif, VRF-lite

Shows and changes the policy rules that pick which routing table a packet is looked up in.

Linux keeps many routing tables: main (what ip route shows), local (the device's own addresses) and any numbered ones you fill with ip route add … table N. Rules decide which table a packet uses: they are checked in order of their number (pref), each matching on the incoming card (iif), the source (from), a mark (fwmark) and more, and the first table with a matching route wins. A table with no match lets the lookup go on to the next rule, unless it ends with unreachable default. One table per customer, picked by the card the packet came in on, is how a VRF works underneath.

ip rule command usage

ip rule [show]
ip rule add|del [iif CARD] [from PREFIX] table N pref NUMBER
ip route add|show … table N

Options

iif officeA: packets that came in on this card
from 10.0.1.0/24: packets from this source
table 10: look the packet up in table 10
pref 100: the rule's number: lower numbers are checked first

ip rule examples

ip rule show: Lists every rule in the order they are checked, ending with main and default.
ip rule add iif officeA table 10 pref 100: Routes everything arriving on officeA with table 10.
ip route show table 10: Lists the routes in table 10.
ip route get 192.168.50.10 from 10.0.1.10 iif officeA: Shows the decision for a packet arriving on officeA, including the table used.

Reading the output

$ ip rule show
0:	from all lookup local
100:	from all iif officeA lookup 10
200:	from all iif officeB lookup 20
32766:	from all lookup main
32767:	from all lookup default

Rule 0 sends every packet to local first: the device's own addresses, shared by every table.
iif officeA lookup 10: packets that arrived on officeA use table 10.
Everything no rule claimed ends in main, the table ip route shows.

Pitfalls

A table with no matching route does not drop the packet: the lookup continues with the next rule, often main. End a customer's table with ip route add unreachable default table N.
Routes in a numbered table are not shown by plain ip route: add table N, or table all.

Run it on real machines