ip-rule(8)
Manage IP routing policy rules that determine which routing table to use for packets.
Synopsis
ip rule [ list | add | delete | flush | save | restore ] SELECTOR ACTIONDescription
The ip rule command manages the kernel's policy-based routing (PBR) rules. Rules determine which routing table will be consulted to find the route for a packet, based on criteria like source/destination address, protocol, port, or firewall mark.
Rules are evaluated in priority order (lower number = higher priority). Each rule specifies a selector (what packets to match) and an action (which routing table to use, or DROP/REJECT the packet).
Policy-based routing allows advanced traffic management, such as routing packets differently based on source IP, implementing multi-ISP failover, or applying QoS rules without modifying the main routing table.
Common options
| Flag | What it does |
|---|---|
list | Show all policy rules (default action) |
add | Add a new policy rule |
delete | Delete a matching policy rule |
flush | Delete all policy rules |
from PREFIX | Match packets with source address in PREFIX |
to PREFIX | Match packets with destination address in PREFIX |
iif DEVICE | Match packets arriving on interface DEVICE |
oif DEVICE | Match packets leaving on interface DEVICE |
priority NUMBER | Set rule priority (lower = higher priority; default auto-assigned) |
table TABLE | Consult routing table TABLE for matching packets |
fwmark MARK | Match packets with netfilter mark MARK |
action | Use 'table TABLE', 'prohibit', 'reject', or 'blackhole' |
Examples
Display all policy rules in priority order
ip rule listRoute packets from 192.168.1.0/24 using routing table 100
ip rule add from 192.168.1.0/24 table 100Route packets marked with 0x64 (decimal 100) using table 200; works with iptables/nftables
ip rule add fwmark 0x64 table 200Route packets from 10.0.0.0/8 arriving on eth0 using table 50
ip rule add from 10.0.0.0/8 iif eth0 table 50Delete the rule routing 192.168.1.0/24 to table 100
ip rule delete from 192.168.1.0/24 table 100Reject all packets from 10.0.0.1 with priority 100
ip rule add priority 100 from 10.0.0.1 rejectUse the main routing table for destination 172.16.0.0/12, checked after lower-priority rules
ip rule add to 172.16.0.0/12 table main priority 200Delete all policy rules (excluding rule 0, which is the default main table)
ip rule flush