1.\" $OpenBSD: rdomain.4,v 1.19 2022/07/29 18:28:32 kn Exp $ 2.\" 3.\" Copyright (c) 2015 Peter Hessler <phessler@openbsd.org> 4.\" 5.\" Permission to use, copy, modify, and distribute this software for any 6.\" purpose with or without fee is hereby granted, provided that the above 7.\" copyright notice and this permission notice appear in all copies. 8.\" 9.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16.\" 17.Dd $Mdocdate: July 29 2022 $ 18.Dt RDOMAIN 4 19.Os 20.Sh NAME 21.Nm rtable , 22.Nm rdomain 23.Nd routing tables and routing domains 24.Sh DESCRIPTION 25The traditional kernel routing system had a single table for routes and 26allowed only non-conflicting IP address assignments. 27The 28.Nm rtable 29feature allows multiple lookup tables for routes. 30The 31.Nm rdomain 32feature provides a way to logically segment a router 33between network paths. 34.Ss Routing tables 35Each 36.Nm rtable 37contains routes for outbound network packets. 38A routing domain can contain more than one 39.Nm rtable . 40Multiple routing tables are commonly used for Policy Based Routing. 41.Pp 42The highest ID that can be used for an 43.Nm rtable 44is 255. 45.Ss Routing domains 46Each 47.Nm rdomain 48is a completely separate address space in the kernel. 49An IP address (e.g. 10.0.0.1/16) can be assigned in more than one 50.Nm rdomain , 51but cannot be assigned more than once per 52.Nm rdomain . 53An interface belongs to one and only one 54.Nm rdomain . 55The interface's 56.Nm rdomain 57determines which rdomain an incoming packet will 58be in. 59Virtual interfaces do not need to belong to the same 60.Nm rdomain 61as the parent. 62Each 63.Nm rdomain 64contains at least one routing table. 65.Pp 66Network traffic within an 67.Nm rdomain 68stays within the current routing domain. 69.Xr pf 4 70is used to move traffic from one 71.Nm rdomain 72to a different 73.Nm rdomain . 74.Pp 75When an interface is assigned to a non-existent 76.Nm rdomain , 77it gets created automatically. 78At the same time an 79.Nm rtable 80with the same ID and a 81.Xr lo 4 82interface with a unit number matching the ID get created and assigned to the new 83domain. 84.Pp 85An rdomain can be deleted by removing all interfaces from it and then 86destroying the 87.Xr lo 4 88interface with the unit number matching the ID. 89.Pp 90The highest ID that can be used for an 91.Nm rdomain 92is 255. 93.Sh EXAMPLES 94Put em0 and lo4 in rdomain 4: 95.Bd -literal -offset indent 96# ifconfig em0 rdomain 4 97# ifconfig lo4 inet 127.0.0.1/8 98# ifconfig em0 192.0.2.100/24 99.Ed 100.Pp 101List all rdomains with associated interfaces and routing tables: 102.Pp 103.Dl $ netstat -R 104.Pp 105Set a default route and localhost reject route within rtable 4: 106.Bd -literal -offset indent 107# route -T4 -qn add -net 127 127.0.0.1 -reject 108# route -T4 -n add default 192.0.2.1 109.Ed 110.Pp 111Start 112.Xr sshd 8 113in rtable 4: 114.Pp 115.Dl # route -T4 exec /usr/sbin/sshd 116.Pp 117Display the routing table used by each process: 118.Pp 119.Dl $ ps aux -o rtable 120.Pp 121Display the routing table of the current process: 122.Pp 123.Dl $ id -R 124.Pp 125A 126.Xr pf.conf 5 127snippet to block incoming port 80, 128and nat-to and move to rtable 0 on interface em1: 129.Bd -literal -offset indent 130block in on rdomain 4 proto tcp to any port 80 131match out on rdomain 4 to !$internal_net nat-to (em1) rtable 0 132.Ed 133.Pp 134Delete rdomain 4 again: 135.Bd -literal -offset indent 136# ifconfig em0 -rdomain 137# ifconfig lo4 destroy 138.Ed 139.Sh SEE ALSO 140.Xr id 1 , 141.Xr netstat 1 , 142.Xr ps 1 , 143.Xr lo 4 , 144.Xr route 4 , 145.Xr pf.conf 5 , 146.Xr ifconfig 8 , 147.Xr route 8 148.Sh HISTORY 149.Ox 150support for 151.Nm rdomain 152first appeared in 153.Ox 4.9 154and IPv6 support first appeared in 155.Ox 5.5 . 156.Sh CAVEATS 157No tool is available to assign more than one rtable to an rdomain 158other than to the default one (0). 159.Pp 160An rtable cannot be deleted. 161Deleting an rdomain will move its rtable into the default rdomain. 162