— routing tables and routing domains
The traditional kernel routing system had a single table for routes and allowed
only non-conflicting IP address assignments. The
feature allows multiple lookup tables for
routes. The rdomain
feature provides a way to
logically segment a router between network paths.
contains routes for outbound network
packets. A routing domain can contain more than one
. Multiple routing tables are commonly used
for Policy Based Routing.
The highest ID that can be used for an rtable
is a completely separate address space
in the kernel. An IP address (e.g. 10.0.0.1/16) can be assigned in more than
, but cannot be assigned more than
once per rdomain
. An interface belongs to one and
only one rdomain
. The interface's
determines which rdomain an incoming
packet will be in. Virtual interfaces do not need to belong to the same
as the parent. Each
contains at least one routing table.
Network traffic within an rdomain
stays within the
current routing domain. pf(4)
used to move traffic from one rdomain
When an interface is assigned to a non-existent
it gets created automatically. At the
same time an rtable
with the same ID and a
interface with a unit number
matching the ID get created and assigned to the new domain.
The highest ID that can be used for an rdomain
Put em0 and lo4 in rdomain 4:
# ifconfig em0 rdomain 4
# ifconfig lo4 inet 127.0.0.1/8
# ifconfig em0 192.0.2.100/24
Set a default route and localhost reject route within rdomain 4:
# route -T4 -qn add -net 127 127.0.0.1 -reject
# route -T4 -n add default 192.0.2.1
in rdomain 4:
# route -T4 exec /usr/sbin/sshd
Display to which rdomain processes are assigned:
# ps aux -o rtable
snippet to block
incoming port 80, and nat-to and move to rtable 0 on interface em1:
block in on rdomain 4 proto tcp to any port 80
match out on rdomain 4 to !$internal_net nat-to (em1) rtable 0
support for rdomain
first appeared in OpenBSD 4.9
and IPv6 support first
appeared in OpenBSD 5.5
When an rtable already exists, a new domain with the same ID cannot be created.
Since there is no command to destroy an rtable, a reboot is necessary.
No tool is available to assign more than one rtable to an rdomain other than to
the default one (0).