IP-RULE(8)

🎀 NAME 🎀

okay bestie, this is the manual page for ip-rule, the Linux tool for routing policy database management 💅 so ip rule is how you play with the routing policy database 🦋

💜 SYNOPSIS 💜

ip [ OPTIONS ] rule { COMMAND | help }

ip rule [ show [ SELECTOR ]]

ip rule { add | del } SELECTOR ACTION

ip rule { flush | save | restore }

SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ dscp
        DSCP[/MASK] ] [ fwmark FWMARK[/MASK] ] [ iif STRING ] [ oif
        STRING ] [ priority PREFERENCE ] [ l3mdev ] [ uidrange NUMBER-
        NUMBER ] [ ipproto PROTOCOL ] [ sport [ NUMBER[/MASK] | NUMBER-
        NUMBER ] ] [ dport [ NUMBER[/MASK] | NUMBER-NUMBER ] ] [ tun_id
        TUN_ID ] [ flowlabel FLOWLABEL[/MASK] ]

ACTION := [ table TABLE_ID ] [ protocol PROTO ] [ nat ADDRESS ] [ realms
        [SRCREALM/]DSTREALM ] [ goto NUMBER ] SUPPRESSOR

SUPPRESSOR := [ suppress_prefixlength NUMBER ] [ suppress_ifgroup GROUP
        ]

TABLE_ID := [ local | main | default | NUMBER ]

🌸 DESCRIPTION 🌸

okay so ip rule is how you manipulate the rules in the routing policy database, which is the thing that controls the route selection algorithm 😭✨

Classic internet routing is kinda basic. It only makes decisions based on the destination address of packets (and in theory, but not in practice, on the TOS field) 🙄

But sometimes we want to route packets differently depending on more than just where they're going. We might care about the source address, the IP protocol, the transport protocol ports, or even the packet payload 👀 This slay of a task is called 'policy routing' 💅

So instead of the usual destination-based routing table, ordered by the longest match rule, we swap it out for a 'routing policy database' (or RPDB) 🦋 The RPDB picks routes by running through a set of rules 🔥

Each policy routing rule is made of a selector and an action predicate 💖 The RPDB gets scanned in order of decreasing priority. Quick reminder that a lower number means higher priority, see the description of PREFERENCE below 🙈 The selector of each rule gets applied to {source address, destination address, incoming interface, tos, fwmark}. If the selector matches the packet, the action is performed ✨ The action predicate can return with success. When that happens, it gives either a route or a failure indication, and the RPDB lookup is done 💅 Otherwise, the RPDB program just moves on to the next rule 🧚

Semantically, the natural action is to pick the nexthop and the output device 🌈

At startup, the kernel sets up the default RPDB, which has three rules 👑

1. Priority: 0, Selector: match anything, Action: lookup routing table local (ID 255). The local table is a special routing table with high priority control routes for local and broadcast addresses 💜
2. Priority: 32766, Selector: match anything, Action: lookup routing table main (ID 254). The main table is the normal routing table with all the non-policy routes 🌸 This rule can be deleted and/or overridden with other ones by the administrator 🙈
3. Priority: 32767, Selector: match anything, Action: lookup routing table default (ID 253). The default table is empty 🫶 It's reserved for some post-processing if no previous default rules selected the packet 💅 This rule can also be deleted ✨

Each RPDB entry has extra attributes, bestie 🎀 For example, each rule has a pointer to some routing table. NAT and masquerading rules have an attribute to select a new IP address to translate or masquerade to 🦋 Rules can also have some optional attributes that routes have too, namely realms 🌈 These values don't override the ones in the routing tables 😤 They only get used if the route didn't select any attributes 💖

The RPDB can have rules of these types 🔥

• unicast — the rule returns the route found in the routing table the rule references 🧚
• blackhole — the rule causes a silent drop of the packet 🤫
• unreachable — the rule generates a Network is unreachable error 💀
• prohibit — the rule generates a Communication is administratively prohibited error 🙅‍♀️
• nat — the rule translates the source address of the IP packet into some other value 🦋

✨ ip rule add ✨

Use ip rule add to insert a new rule 💖

🗑️ ip rule delete 🗑️

Use ip rule delete to delete a rule 😭

Here are the things you can set when you add or delete a rule 💅

• type TYPE (default) — the type of this rule. The valid types were listed in the previous part of this page 🌈
• from PREFIX — picks the source prefix to match 🧚
• to PREFIX — picks the destination prefix to match 🦋
• iif NAME — picks the incoming device to match 🫶 If the interface is loopback, the rule only matches packets that started from this host. So you can make separate routing tables for forwarded and local packets and totally separate them, periodt 👑
• oif NAME — picks the outgoing device to match 💅 The outgoing interface only works for packets coming from local sockets that are bound to a device 🙈
• tos TOS
• dsfield TOS — picks the TOS value to match ✨
• dscp DSCP[/MASK] — picks the DSCP value to match, with an optional mask 💖 DSCP values can be written as plain numbers (valid values are 0-63), or with symbolic names from /usr/share/iproute2/rt_dsfield or /etc/iproute2/rt_dsfield 🌸 The /etc one wins if it exists 🙌 Heads up though, that file has full 8-bit dsfield values, but ip rule only uses the higher six bits 🤓 ip rule show will also show DSCP values as symbolic names when it can 💅 The command line option -N turns that show translation off 🚫
• fwmark MARK — picks the fwmark value to match 🔥
• uidrange NUMBER-NUMBER — picks the uid value to match 🧚
• ipproto PROTOCOL — picks the ip protocol value to match 🌈
• sport NUMBER[/MASK] | NUMBER-NUMBER — picks the source port value to match, with an optional mask 🦋 It supports port ranges too ✨
• dport NUMBER[/MASK] | NUMBER-NUMBER — picks the destination port value to match, with an optional mask 💜 It supports port ranges too 🫶
• priority PREFERENCE — the priority of this rule 👑 PREFERENCE is an unsigned integer. A higher number means lower priority, and rules get processed in order of increasing number 🙈 Every rule should have an explicitly set, unique priority value 😤 The options preference and order are synonyms for priority 💅
• table TABLEID — the routing table identifier to look up if the rule selector matches 🌸 You can also use lookup instead of table ✨
• protocol PROTO — the routing protocol that installed the rule 🧚 For example, when zebra installs a rule, it would get RTPROT_ZEBRA as the installing protocol 💖
• suppress_prefixlength NUMBER — rejects routing decisions that have a prefix length of NUMBER or less 🚫
• suppress_ifgroup GROUP — rejects routing decisions that use a device belonging to the interface group GROUP 🙅‍♀️
• realms FROM/TO — the realms to select if the rule matched and the routing table lookup succeeded 🌈 Realm TO only gets used if the route didn't select any realm 🫶
• nat ADDRESS — the base of the IP address block to translate (for source addresses) 🦋 ADDRESS can be either the start of the block of NAT addresses (selected by NAT routes), or a local host address (or even zero) 💅 In that last case, the router doesn't translate the packets, it masquerades them to this address 👀 Using map-to instead of nat means the same thing 💖
• flowlabel FLOWLABEL[/MASK] — picks the IPv6 flow label to match, with an optional mask 🧚

⚠️ Warning: Changes to the RPDB made with these commands don't become active immediately 😭 It's assumed that after a script finishes a batch of updates, it flushes the routing cache with ip route flush cache 💀

🧹 ip rule flush 🧹

ip rule flush also dumps all the deleted rules 💅

• protocol PROTO — selects the originating protocol 🌸

📋 ip rule show 📋

ip rule show lists the rules ✨ This command has no arguments 🙈 The options list or lst are synonyms for show 💜

💾 ip rule save 💾

• protocol PROTO — selects the originating protocol 🦋

ip rule save saves rules table information to stdout 🫶 This command acts like ip rule show, except the output is raw data that's suitable for passing to ip rule restore 🌈

♻️ ip rule restore ♻️

ip rule restore restores rules table information from stdin 🧚 This command expects a data stream like the one returned from ip rule save 💖 It tries to restore the rules table information exactly as it was at the time of the save 👑 Any rules already in the table are left unchanged, and duplicates are not ignored 😤 Be careful with that one, bestie 🙈

🦋 SEE ALSO 🦋

ip(8) 💖

👩‍💻 AUTHOR 👩‍💻

Original Manpage by Michail Litvak <mci@owl.openwall.com> 🫶

---

That's the whole tea on ip-rule, from iproute2 🩷 last updated 20 Dec 2011, so the vibes are a little vintage but still iconic 💅✨ stay routed, stay slay, see you in the RPDB 🧚🌈💜