Routing

Most important commands to remember

• ip route get ADDRESS — ask Linux for a routing decision.
• ip rule show — inspect which routing policies select tables.

Commands and flags

Command or argument	Meaning
ip -4 rule show	Show IPv4 policy rules in priority order.
ip -4 route show table main	Display the main IPv4 routing table.
ip -4 route get 192.0.2.1	Resolve a route locally for a documentation address, without sending a packet.

-4 selects IPv4. This example performs no route changes.

The concepts that matter

1. A route chooses the next step

Routing decides where a packet goes next. A route connects a destination prefix to an outgoing interface and sometimes a gateway. A router repeats this decision for traffic it forwards; it need not know every future hop.

A directly connected route normally sends toward the destination on the local link. A gateway route sends toward another router. Local delivery to this machine is a separate outcome, not forwarding through a network interface to a remote host.

2. More specific prefixes beat broader ones

Within an ordinary routing-table lookup, the longest matching prefix is preferred. A route for 192.0.2.0/24 is more specific than a default route covering all IPv4 addresses.

Metrics can distinguish otherwise comparable routes; a lower metric does not make a default route defeat a more specific destination prefix. A default route is a fallback for unmatched destinations, not a promise that its gateway can reach everything.

3. Policy can select another table

Linux can hold multiple routing tables. Policy rules decide which table to consult using criteria such as source address, packet mark, or incoming interface. Rule priority and route specificity are separate decisions.

This explains why reading only the main table can miss the route used by a VPN or a workload with special policy. A route lookup without the real packet’s source or mark describes the supplied lookup context, not every possible packet to that destination.

4. The reply needs its own working route

A request and its reply are routed independently. A correct outgoing path can coexist with a missing return route. Asymmetric routing is possible and can interact with stateful firewalls or reverse-path checks.

Routing also differs from forwarding permission. An interface can be up and a route present while forwarding is disabled or filtering blocks traffic. A routing decision is one piece of evidence; neighbor resolution and application behavior remain separate.

One small example

Optional: run the commands in a Linux terminal. No administrator access or external traffic is required.

ip -4 rule show
ip -4 route show table main
ip -4 route get 192.0.2.1

Read the rule priorities first; lower numbers are considered earlier. Rules commonly consult local, main, and default tables, but your configuration can differ. A rule line is not itself a destination route.

In the main table, compare prefixes, via gateways, dev interfaces, and any metrics. The final lookup shows Linux’s selected result, including src where appropriate. cache, if printed, refers to the resolved lookup result rather than cached payload data.

A local, unreachable, or policy-specific result can be legitimate. No successful lookup proves the documentation destination exists. Nothing was changed, so no cleanup is needed.

Keep this idea: Policy selects the routing context; matching routes select the next hop; replies need their own route.