# Gentoo routing table mystery

## durty_nacho

Gentoo 2007.0

Kernel 2.6.24.2

I am using a dedicated box running 2007.0 as my gateway to the net. It is running all of my network services; NAT, DHCP, DNS, iptables, etc. Routing works fine, everything works perfectly. However, I noticed the other day that my gateway's routing table is always fairly empty, having only the routes it needs (i.e. route to LAN, next hop route to telco network), and that's it. However, my internal machines routing tables are full, with specific routes to places like google.com, my mail provider, and others.

This seems backwards to me. Shouldn't it be my gateway box that has the populated routing table and my internal machines should only know about the next hop routes? It seems to me all it should ever know is to forward its packets to the gateway. NAT config below:

NAT

```

*nat

:PREROUTING ACCEPT [24108159:4601130977]

:POSTROUTING ACCEPT [930176:72217135]

:OUTPUT ACCEPT [1135376:105338287]

-A PREROUTING -i eth0 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 10.10.10.11:3389 

-A POSTROUTING -o eth0 -j MASQUERADE 

COMMIT

*filter

:INPUT ACCEPT [44983442:19635343854]

:FORWARD DROP [1155:330308]

:OUTPUT ACCEPT [460428596:356109379957]

:blockhosts - [0:0]

-A INPUT -i lo -j ACCEPT 

-A INPUT -i eth1 -j ACCEPT 

-A INPUT -i tun+ -j ACCEPT 

-A INPUT -i eth0 -j blockhosts 

-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -j DROP 

-A INPUT -i eth0 -p udp -m udp --dport 53 -j REJECT --reject-with icmp-port-unreachable 

-A INPUT -i eth0 -p udp -m udp --dport 67 -j REJECT --reject-with icmp-port-unreachable 

-A INPUT -i eth0 -p tcp -m tcp --dport 20 -j ACCEPT 

-A INPUT -i eth0 -p tcp -m tcp --dport 21 -j ACCEPT 

-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT 

-A INPUT -i eth0 -p udp -m udp --dport 123 -j ACCEPT 

-A INPUT -i eth0 -p tcp -m tcp --dport 995 -j ACCEPT 

-A INPUT -i eth0 -p tcp -m tcp --dport 0:1023 -j DROP 

-A INPUT -i eth0 -p udp -m udp --dport 0:1023 -j DROP 

-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT 

-A INPUT -p icmp -m icmp --icmp-type 4 -j ACCEPT 

-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT 

-A INPUT -i eth1 -p icmp -m icmp --icmp-type 8 -j ACCEPT 

-A INPUT -j blockhosts 

-A FORWARD -d 10.10.10.8/255.255.255.248 -i eth1 -j DROP 

-A FORWARD -s 10.10.10.8/255.255.255.248 -i eth1 -j ACCEPT 

-A FORWARD -d 10.10.10.8/255.255.255.248 -i eth0 -j ACCEPT 

-A FORWARD -i tun+ -j ACCEPT 

-A blockhosts -s 67.227.197.19 -j DROP 

-A blockhosts -s 219.134.242.67 -j DROP 

-A blockhosts -s 211.192.64.138 -j DROP 

COMMIT

```

Gentoo routing table

```

gateway.milhouse.org /etc # route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

10.10.10.8      *               255.255.255.248 U     0      0        0 eth1

cpe-67-9-240-0. *               255.255.240.0   U     0      0        0 eth0

loopback        *               255.0.0.0       U     0      0        0 lo

default         cpe-67-9-240-1. 0.0.0.0         UG    0      0        0 eth0

```

LAN machines routing table has a bunch of entries in it for external hosts. Isn't this backwards? Shouldn't it be the other way around? Or does the machine that actually makes the request get to add and keep entries in its own table? That would explain this...

Thank you in advance!

----------

## doctork

If your gateway is really being used as a gateway by your LAN system, the LAN system should not even know about routes to systems outside the LAN much less have entries for them in its routing table.  The LAN system should be routing everything to the gateway.  You might want to post the LAN system routing table and the output of ifconfig on both the gateway and LAN systems.

--

doc

----------

## durty_nacho

Yes Doc, this is my point exactly. Below is my ifconfig on my gateway; my LAN systems are Windows machines. My LAN is 10.10.10.8/28, with 10.10.10.9 being my gateway. 10.10.10.11 is a Windows machine.

NOTE: My ifconfig has my public IP and MAC hidden; there is not an error with those entries.

ifconfig from gateway

```

gateway.milhouse.org /etc # ifconfig           

eth0      Link encap:Ethernet  HWaddr MAC_ADDRESS  

          inet addr:PUBLIC_IP  Bcast:255.255.255.255  Mask:255.255.240.0

          UP BROADCAST RUNNING MULTICAST  MTU:576  Metric:1

          RX packets:1374387 errors:0 dropped:0 overruns:0 frame:0

          TX packets:22925 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:108349824 (103.3 Mb)  TX bytes:3022963 (2.8 Mb)

          Interrupt:17 Base address:0x8c00 

eth1      Link encap:Ethernet  HWaddr MAC_ADDRESS  

          inet addr:10.10.10.9  Bcast:10.10.10.15  Mask:255.255.255.248

          inet6 addr: fe80::230:bdff:fe1f:9ac/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:22100 errors:0 dropped:0 overruns:0 frame:0

          TX packets:26625 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:3030600 (2.8 Mb)  TX bytes:20405408 (19.4 Mb)

          Interrupt:21 Base address:0xa800 

lo        Link encap:Local Loopback  

          inet addr:127.0.0.1  Mask:255.0.0.0

          inet6 addr: ::1/128 Scope:Host

          UP LOOPBACK RUNNING  MTU:16436  Metric:1

          RX packets:19 errors:0 dropped:0 overruns:0 frame:0

          TX packets:19 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:2315 (2.2 Kb)  TX bytes:2315 (2.2 Kb)

```

Windows routing table

```

Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

          0.0.0.0          0.0.0.0       10.10.10.9     10.10.10.11       10

       10.10.10.8  255.255.255.248      10.10.10.11     10.10.10.11       10

      10.10.10.11  255.255.255.255        127.0.0.1       127.0.0.1       10

   10.255.255.255  255.255.255.255      10.10.10.11     10.10.10.11       10

     72.246.98.99  255.255.255.255       10.10.10.9     10.10.10.11       10

    72.246.98.104  255.255.255.255       10.10.10.9     10.10.10.11       10

    72.246.98.112  255.255.255.255       10.10.10.9     10.10.10.11       10

        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1

   198.105.194.76  255.255.255.255       10.10.10.9     10.10.10.11       10

     199.16.83.72  255.255.255.255       10.10.10.9     10.10.10.11       10

     216.73.87.52  255.255.255.255       10.10.10.9     10.10.10.11       10

        224.0.0.0        240.0.0.0      10.10.10.11     10.10.10.11       10

  255.255.255.255  255.255.255.255      10.10.10.11     10.10.10.11       1

  255.255.255.255  255.255.255.255      10.10.10.11               3       1

Default Gateway:        10.10.10.9

===========================================================================

Persistent Routes:

  None

```

----------

## ScarletPimpFromHell

I could be wrong, but this looks to be a FIB. A Forwarding Information Base. I don't remember seeing any option in the kernel for FIB support though. Might be worth another look.

The basic premise is that after the router forwards the first packet via process routing ( looking up the routing table ) a destination route entry is placed into the FIB cache (see how all of the entries are host destination addresses, ie netmask 255.255.255.255). All subsequent forwarding first examines the HASH table FIB (a bucket load quicker) for an entry before doing a process intensive routing table lookup.

Just a thought, don't quote me I may be wrong.

----------

## durty_nacho

I have looked in the kernel under Networking > Networking Options. There is a module called IP: Advanced Router:

```

[*]   IP: advanced router                

Choose IP: FIB lookup algorithm (choose FIB_HASH if unsure) (FIB_HASH)  --->

```

And when I expand 'Choose IP: FIB..." I am forced to chose one of the following (my selection is below):

```

(X) FIB_HASH

( ) FIB_TRIE  

```

So it would appear this is indeed enabled. FIB in concept however, given this is a home router and not a WAN router, seems like having this setup would achieve better results/faster routing? I haven't tried taking it out to see how if my routing breaks, or looks normal. I plan to try this soon though....

Thank you so much for the tip, I will post my results here as soon as I can test it.

----------

