We're currently trying to route all packets from our guest vlan's (eth1.251) subnet trough a wireguard tunnel into the internet. To accomplish this we're using policy based routing with a rule to use the routing table 10 when the traffic is comming from our guest subnet:

32765:  from lookup 10

In routing table 10 we're creating a default route towards our tunnel interface:

default dev wg1  scope link

All of our clients in our guest network are able to reache the internet through the wireguard tunnel which is expected, however the client's cannot reach the gateway for the guest network ( TCPDump shows that the ICMP echo reply is routed back trough the wg1 interface to our tunnel endpoint, which is obviously not intended. A quick solution for this is to add the scope link route for the eth1.251 guest vlan interface to the routing table 10:

default dev wg1  scope link dev eth1.251  proto kernel  scope link 

Now the client can reach the router interface and it services.

On this router is another interface eth1 with the subnet When we now delete our newly added route in table 10 we cannot reach the routers interface on anymore, however we're still able to reach the interface from a client on the subnet. The clients (e.g behind the router in the subnet aren't rechable from

Main Question: Why can we reach the interface ip on our router without an explicit routing table entry, but not the interface ip from our clients in the guest subnet?

Here's an overview of the network structure. I think this helps to unterstand our setup.

Router interfaces overview


There's no general explanation, it's just the matter of following what happens in the routing settings., is both a local router address and part of

When receiving a packet to a local address, the router matches the local table using the very first ip rule with lowest preference: 0, before the rule for table 10, and matches. Remember that routing tables match on destinations, while usually the custom rules are configured to match on sources.

When the router replies, this time the local table doesn't match: is not a local destination. Next rule is checked and matches from, looks up table 10 and packet goes through wg1.

For, receiving the packet is exactly like before with the local table. Now the answer doesn't match the additional rule, and the main routing table applies: it works as usual: a Linux system will answer from any of its IPs.

Again, for it's not a local IP, so doesn't match the local table, but the query does match the added rule: packets are lost through wg1.

So copying a part of the main routing table to the extra table to avoid side effects helps.

Many of this can be tested with ip route get and the correct syntax, as long as there are no marks involved:

Without the additional entry in table 10:

# ip route get from iif eth1.251
RTNETLINK answers: Invalid cross-device link
# sysctl -w net.ipv4.conf.eth1/251.rp_filter=2 #relax reverse path filtering
# ip route get from iif eth1.251
local from dev lo table local 
    cache <local> iif eth1.251 

# ip route get from iif eth1.251
local from dev lo table local 
    cache <local> iif eth1.251 
# ip route get from iif eth1.251 from dev wg1 table 10 
    cache iif eth1.251 

reply route:

# ip route get from from dev wg1 table 10 uid 0 
# ip route get from from dev eth1.251 uid 0 

When adding the entry in table 10:

# ip route get from iif eth1.251 #even with strict reverse path filtering, since the reverse route is correct
local from dev lo table local 
    cache <local> iif eth1.251 
# ip route get from from dev eth1.251 table 10 uid 0 
| improve this answer | |
  • Thank you very much, that makes absolutely sense. I just figured out instead of adding the other interface rules to the routing table 10 you can add the source interface to the ip rule from "". This works perfectly fine and feels less hacky then adding all rules to the routing table 10. – ForJ9 Jan 28 at 12:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.