538 lines
10 KiB
HTML
538 lines
10 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of IP-RULE</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>IP-RULE</H1>
|
|
Section: Linux (8)<BR>Updated: 20 Dec 2011<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
ip-rule - routing policy database management
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<P>
|
|
|
|
|
|
<BR>
|
|
|
|
<B>ip</B>
|
|
|
|
[ <I>OPTIONS</I> ]
|
|
|
|
<B>rule</B>
|
|
|
|
{ <I>COMMAND</I> |
|
|
|
|
<B>help</B> }
|
|
|
|
<P>
|
|
<P>
|
|
<BR>
|
|
|
|
<B>ip rule</B>
|
|
|
|
[ <B>list</B>
|
|
|
|
[ <I>SELECTOR</I> ]]
|
|
|
|
<P>
|
|
<BR>
|
|
|
|
<B>ip rule</B>
|
|
|
|
{ <B>add</B> | <B>del</B> }
|
|
|
|
<I>SELECTOR ACTION</I>
|
|
|
|
<P>
|
|
<BR>
|
|
|
|
<B>ip rule</B>
|
|
|
|
{ <B>flush</B> | <B>save</B> | <B>restore</B> }
|
|
|
|
<P>
|
|
<BR>
|
|
|
|
<I>SELECTOR</I> := [
|
|
|
|
<B>not</B> ] [
|
|
|
|
<B>from</B>
|
|
|
|
<I>PREFIX</I> ] [
|
|
|
|
<B>to</B>
|
|
|
|
<I>PREFIX</I> ] [
|
|
|
|
<B>tos</B>
|
|
|
|
<I>TOS</I> ] [
|
|
|
|
<B>fwmark</B>
|
|
|
|
<I>FWMARK</I>[<B>/</B><I>MASK</I>] ] [
|
|
|
|
<B>iif</B>
|
|
|
|
<I>STRING</I> ] [
|
|
|
|
<B>oif</B>
|
|
|
|
<I>STRING</I> ] [
|
|
|
|
<B>pref</B>
|
|
|
|
<I>NUMBER</I> ] [
|
|
|
|
<I>l3mdev</I> ] [
|
|
|
|
<B>uidrange</B>
|
|
|
|
<I>NUMBER</I>-<I>NUMBER</I> ] [
|
|
|
|
<B>ipproto</B>
|
|
|
|
<I>PROTOCOL</I> ] [
|
|
|
|
<B>sport</B> [
|
|
|
|
<I>NUMBER</I> |
|
|
|
|
<I>NUMBER</I>-<I>NUMBER</I> ] ] [
|
|
|
|
<B>dport</B> [
|
|
|
|
<I>NUMBER</I> |
|
|
|
|
<I>NUMBER</I>-<I>NUMBER</I> ] ] [
|
|
|
|
<B>tun_id</B>
|
|
|
|
<I>TUN_ID</I> ]
|
|
|
|
|
|
<P>
|
|
<P>
|
|
<BR>
|
|
|
|
<I>ACTION</I> := [
|
|
|
|
<B>table</B>
|
|
|
|
<I>TABLE_ID</I> ] [
|
|
|
|
<B>protocol</B>
|
|
|
|
<I>PROTO</I> ] [
|
|
|
|
<B>nat</B>
|
|
|
|
<I>ADDRESS</I> ] [
|
|
|
|
<B>realms</B>
|
|
|
|
[<I>SRCREALM</I><B>/</B>]<I>DSTREALM</I> ] [
|
|
|
|
<B>goto</B>
|
|
|
|
<I>NUMBER</I> ] <I>SUPPRESSOR</I>
|
|
|
|
<P>
|
|
<BR>
|
|
|
|
<I>SUPPRESSOR</I> := [
|
|
|
|
<B>suppress_prefixlength</B>
|
|
|
|
<I>NUMBER</I> ] [
|
|
|
|
<B>suppress_ifgroup</B>
|
|
|
|
<I>GROUP</I> ]
|
|
|
|
<P>
|
|
<BR>
|
|
|
|
<I>TABLE_ID</I> := [
|
|
|
|
<B>local</B> | <B>main</B> | <B>default</B> |
|
|
|
|
<I>NUMBER</I> ]
|
|
|
|
<P>
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<I>ip rule</I>
|
|
|
|
manipulates rules
|
|
in the routing policy database control the route selection algorithm.
|
|
<P>
|
|
<P>
|
|
|
|
Classic routing algorithms used in the Internet make routing decisions
|
|
based only on the destination address of packets (and in theory,
|
|
but not in practice, on the TOS field).
|
|
<P>
|
|
<P>
|
|
|
|
In some circumstances we want to route packets differently depending not only
|
|
on destination addresses, but also on other packet fields: source address,
|
|
IP protocol, transport protocol ports or even packet payload.
|
|
This task is called 'policy routing'.
|
|
<P>
|
|
<P>
|
|
|
|
To solve this task, the conventional destination based routing table, ordered
|
|
according to the longest match rule, is replaced with a 'routing policy
|
|
database' (or RPDB), which selects routes by executing some set of rules.
|
|
<P>
|
|
<P>
|
|
|
|
Each policy routing rule consists of a
|
|
<B>selector</B>
|
|
|
|
and an
|
|
<B>action predicate.</B>
|
|
|
|
The RPDB is scanned in order of decreasing priority (note that lower number
|
|
means higher priority, see the description of
|
|
<I>PREFERENCE</I>
|
|
|
|
below). The selector
|
|
of each rule is applied to {source address, destination address, incoming
|
|
interface, tos, fwmark} and, if the selector matches the packet,
|
|
the action is performed. The action predicate may return with success.
|
|
In this case, it will either give a route or failure indication
|
|
and the RPDB lookup is terminated. Otherwise, the RPDB program
|
|
continues with the next rule.
|
|
<P>
|
|
<P>
|
|
|
|
Semantically, the natural action is to select the nexthop and the output device.
|
|
<P>
|
|
<P>
|
|
|
|
At startup time the kernel configures the default RPDB consisting of three
|
|
rules:
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="1">1.<DD>
|
|
Priority: 0, Selector: match anything, Action: lookup routing
|
|
table
|
|
<B>local</B>
|
|
|
|
(ID 255).
|
|
The
|
|
<B>local</B>
|
|
|
|
table is a special routing table containing
|
|
high priority control routes for local and broadcast addresses.
|
|
<P>
|
|
<DT id="2">2.<DD>
|
|
Priority: 32766, Selector: match anything, Action: lookup routing
|
|
table
|
|
<B>main</B>
|
|
|
|
(ID 254).
|
|
The
|
|
<B>main</B>
|
|
|
|
table is the normal routing table containing all non-policy
|
|
routes. This rule may be deleted and/or overridden with other
|
|
ones by the administrator.
|
|
<P>
|
|
<DT id="3">3.<DD>
|
|
Priority: 32767, Selector: match anything, Action: lookup routing
|
|
table
|
|
<B>default</B>
|
|
|
|
(ID 253).
|
|
The
|
|
<B>default</B>
|
|
|
|
table is empty. It is reserved for some post-processing if no previous
|
|
default rules selected the packet.
|
|
This rule may also be deleted.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
Each RPDB entry has additional
|
|
attributes. F.e. each rule has a pointer to some routing
|
|
table. NAT and masquerading rules have an attribute to select new IP
|
|
address to translate/masquerade. Besides that, rules have some
|
|
optional attributes, which routes have, namely
|
|
<B>realms</B>.
|
|
|
|
These values do not override those contained in the routing tables. They
|
|
are only used if the route did not select any attributes.
|
|
<P>
|
|
<P>
|
|
The RPDB may contain rules of the following types:
|
|
<P>
|
|
<DL COMPACT><DT id="4"><DD>
|
|
<B>unicast</B>
|
|
|
|
- the rule prescribes to return the route found
|
|
in the routing table referenced by the rule.
|
|
<P>
|
|
<B>blackhole</B>
|
|
|
|
- the rule prescribes to silently drop the packet.
|
|
<P>
|
|
<B>unreachable</B>
|
|
|
|
- the rule prescribes to generate a 'Network is unreachable' error.
|
|
<P>
|
|
<B>prohibit</B>
|
|
|
|
- the rule prescribes to generate 'Communication is administratively
|
|
prohibited' error.
|
|
<P>
|
|
<B>nat</B>
|
|
|
|
- the rule prescribes to translate the source address
|
|
of the IP packet into some other value.
|
|
</DL>
|
|
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="5"><B>ip rule add - insert a new rule</B>
|
|
|
|
<DD>
|
|
<DT id="6"><B>ip rule delete - delete a rule</B>
|
|
|
|
<DD>
|
|
<DL COMPACT><DT id="7"><DD>
|
|
<DL COMPACT>
|
|
<DT id="8"><B>type</B><I> TYPE </I><B>(default)</B>
|
|
|
|
<DD>
|
|
the type of this rule. The list of valid types was given in the previous
|
|
subsection.
|
|
<P>
|
|
<DT id="9"><B>from</B><I> PREFIX</I>
|
|
|
|
<DD>
|
|
select the source prefix to match.
|
|
<P>
|
|
<DT id="10"><B>to</B><I> PREFIX</I>
|
|
|
|
<DD>
|
|
select the destination prefix to match.
|
|
<P>
|
|
<DT id="11"><B>iif</B><I> NAME</I>
|
|
|
|
<DD>
|
|
select the incoming device to match. If the interface is loopback,
|
|
the rule only matches packets originating from this host. This means
|
|
that you may create separate routing tables for forwarded and local
|
|
packets and, hence, completely segregate them.
|
|
<P>
|
|
<DT id="12"><B>oif</B><I> NAME</I>
|
|
|
|
<DD>
|
|
select the outgoing device to match. The outgoing interface is only
|
|
available for packets originating from local sockets that are bound to
|
|
a device.
|
|
<P>
|
|
<DT id="13"><B>tos</B><I> TOS</I>
|
|
|
|
<DD>
|
|
<DT id="14"><B>dsfield</B><I> TOS</I>
|
|
|
|
<DD>
|
|
select the TOS value to match.
|
|
<P>
|
|
<DT id="15"><B>fwmark</B><I> MARK</I>
|
|
|
|
<DD>
|
|
select the
|
|
<B>fwmark</B>
|
|
|
|
value to match.
|
|
<P>
|
|
<DT id="16"><B>uidrange</B><I> NUMBER-NUMBER</I>
|
|
|
|
<DD>
|
|
select the
|
|
<B>uid</B>
|
|
|
|
value to match.
|
|
<P>
|
|
<DT id="17"><B>ipproto</B><I> PROTOCOL</I>
|
|
|
|
<DD>
|
|
select the ip protocol value to match.
|
|
<P>
|
|
<DT id="18"><B>sport</B><I> NUMBER | NUMBER-NUMBER</I>
|
|
|
|
<DD>
|
|
select the source port value to match. supports port range.
|
|
<P>
|
|
<DT id="19"><B>dport</B><I> NUMBER | NUMBER-NUMBER</I>
|
|
|
|
<DD>
|
|
select the destination port value to match. supports port range.
|
|
<P>
|
|
<DT id="20"><B>priority</B><I> PREFERENCE</I>
|
|
|
|
<DD>
|
|
the priority of this rule.
|
|
<I>PREFERENCE</I>
|
|
|
|
is an unsigned integer value, higher number means lower priority, and rules get
|
|
processed in order of increasing number. Each rule
|
|
should have an explicitly set
|
|
<I>unique</I>
|
|
|
|
priority value.
|
|
The options preference and order are synonyms with priority.
|
|
<P>
|
|
<DT id="21"><B>table</B><I> TABLEID</I>
|
|
|
|
<DD>
|
|
the routing table identifier to lookup if the rule selector matches.
|
|
It is also possible to use lookup instead of table.
|
|
<P>
|
|
<DT id="22"><B>protocol</B><I> PROTO</I>
|
|
|
|
<DD>
|
|
the routing protocol who installed the rule in question. As an example when zebra installs a rule it would get RTPROT_ZEBRA as the installing protocol.
|
|
<P>
|
|
<DT id="23"><B>suppress_prefixlength</B><I> NUMBER</I>
|
|
|
|
<DD>
|
|
reject routing decisions that have a prefix length of NUMBER or less.
|
|
<P>
|
|
<DT id="24"><B>suppress_ifgroup</B><I> GROUP</I>
|
|
|
|
<DD>
|
|
reject routing decisions that use a device belonging to the interface
|
|
group GROUP.
|
|
<P>
|
|
<DT id="25"><B>realms</B><I> FROM/TO</I>
|
|
|
|
<DD>
|
|
Realms to select if the rule matched and the routing table lookup
|
|
succeeded. Realm
|
|
<I>TO</I>
|
|
|
|
is only used if the route did not select any realm.
|
|
<P>
|
|
<DT id="26"><B>nat</B><I> ADDRESS</I>
|
|
|
|
<DD>
|
|
The base of the IP address block to translate (for source addresses).
|
|
The
|
|
<I>ADDRESS</I>
|
|
|
|
may be either the start of the block of NAT addresses (selected by NAT
|
|
routes) or a local host address (or even zero).
|
|
In the last case the router does not translate the packets, but
|
|
masquerades them to this address.
|
|
Using map-to instead of nat means the same thing.
|
|
<P>
|
|
<B>Warning:</B>
|
|
|
|
Changes to the RPDB made with these commands do not become active
|
|
immediately. It is assumed that after a script finishes a batch of
|
|
updates, it flushes the routing cache with
|
|
<B>ip route flush cache</B>.
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="27"><B>ip rule flush - also dumps all the deleted rules.</B>
|
|
|
|
<DD>
|
|
<DL COMPACT><DT id="28"><DD>
|
|
<DL COMPACT>
|
|
<DT id="29"><B>protocol</B><I> PROTO</I>
|
|
|
|
<DD>
|
|
Select the originating protocol.
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="30"><B>ip rule show - list rules</B>
|
|
|
|
<DD>
|
|
This command has no arguments.
|
|
The options list or lst are synonyms with show.
|
|
<P>
|
|
<DT id="31"><B>ip rule save</B>
|
|
|
|
<DD>
|
|
<DL COMPACT><DT id="32"><DD>
|
|
<DL COMPACT>
|
|
<DT id="33"><B>protocol</B><I> PROTO</I>
|
|
|
|
<DD>
|
|
Select the originating protocol.
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="34">save rules table information to stdout<DD>
|
|
<DL COMPACT><DT id="35"><DD>
|
|
This command behaves like
|
|
<B>ip rule show</B>
|
|
|
|
except that the output is raw data suitable for passing to
|
|
<B>ip rule restore</B>.
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="36"><B>ip rule restore</B>
|
|
|
|
<DD>
|
|
restore rules table information from stdin
|
|
<DL COMPACT><DT id="37"><DD>
|
|
This command expects to read a data stream as returned from
|
|
<B>ip rule save</B>.
|
|
|
|
It will attempt to restore the rules table information exactly as
|
|
it was at the time of the save. Any rules already in the table are
|
|
left unchanged, and duplicates are not ignored.
|
|
</DL>
|
|
|
|
<P>
|
|
</DL>
|
|
<A NAME="lbAE"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<BR>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+ip">ip</A></B>(8)
|
|
|
|
<P>
|
|
<A NAME="lbAF"> </A>
|
|
<H2>AUTHOR</H2>
|
|
|
|
Original Manpage by Michail Litvak <<A HREF="mailto:mci@owl.openwall.com">mci@owl.openwall.com</A>>
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="38"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="39"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="40"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="41"><A HREF="#lbAE">SEE ALSO</A><DD>
|
|
<DT id="42"><A HREF="#lbAF">AUTHOR</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:13 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|