LFCS 98 🐧 Routing Table — ip route - KandZ

⏱️ Estimated read: 10 min | |

The routing table is the kernel’s map of where to send packets. Every packet destined for an address that is not on a directly connected subnet must be matched against a route entry to determine the next hop—the gateway that will forward the packet toward its destination. Without a default route, a host can only communicate on its local segments. Without specific static routes, traffic to remote networks either fails or takes an unintended path. The ip route command from the iproute2 suite is the modern tool for inspecting and manipulating this table. Like ip addr and ip link, its changes are runtime-only and vanish on reboot unless persisted through a network manager.

Key point: The default route is the route of last resort. If no more specific prefix matches, the packet goes to the default gateway. ip route add and ip route del modify the live kernel table; persistence requires nmcli, Netplan, or systemd-networkd.

Why ip route exists

The next-hop problem. A host knows its own subnet through the address and prefix configured with ip addr. But when a packet is destined for 8.8.8.8, the kernel needs to know which interface to use and which MAC address to send the frame to. The routing table answers this: “send it to the gateway at 192.168.1.1 via eth0, and use 192.168.1.100 as the source address” . The ip route get command exposes this decision directly.

The static route problem. In networks with multiple subnets or complex topologies, a single default gateway is insufficient. A host might need to reach 10.0.0.0/8 through one gateway and 192.168.2.0/24 through another. Static routes allow the administrator to direct traffic for specific prefixes through specific next hops, bypassing the default route when a more specific entry exists .

The metric problem. When multiple routes exist for the same prefix—for example, two default routes on two interfaces—the kernel chooses the one with the lowest metric. This allows a primary and backup gateway configuration. If the primary interface goes down and its route is removed, traffic shifts to the backup with the higher metric . The ip route add ... metric N syntax sets this priority.

The persistence problem. The LFCS exam tests both the immediate command and the knowledge that it does not survive a reboot. A route added with ip route add modifies the running kernel state. To make it permanent, the configuration must be written to the system’s network manager. On RHEL and Fedora, nmcli connection modify ... +ipv4.routes is the tool . On Ubuntu, Netplan YAML files under /etc/netplan/ are the mechanism. The distinction between runtime and persistent is the same as with ip addr and ip link.

The diagnostic problem. When traffic fails, the first question is: which route is the kernel using? ip route get <destination> answers this directly. It returns the exact next hop, interface, and source address the kernel would use for that destination . This is faster and more accurate than reading the entire routing table and manually matching prefixes.

a. Displaying the routing table

The ip route show command (or just ip route) lists every entry in the main routing table. Each line describes a prefix, its next hop (if any), and the interface.

# Show the main routing table
ip route show

# Show the default route only
ip route show default

# Show routes for a specific prefix
ip route show 192.168.0.0/16

The output includes the default entry, which is the route of last resort, and specific entries for directly connected subnets. The proto kernel marker indicates routes automatically added by the kernel when an address was configured. The scope link marker indicates a directly connected route that does not require a gateway .

To check which route the kernel would use for a specific destination, ip route get is the diagnostic tool.

ip route get 8.8.8.8
# Output: 8.8.8.8 via 192.168.1.1 dev eth0 src 192.168.1.100 uid 0

The output names the gateway (via), the interface (dev), and the source address (src) that the kernel selected . If the destination is directly connected, the output omits via and shows only the interface and source.

b. Adding and deleting routes

The add subcommand inserts a new route. The minimum required arguments are the destination prefix and either a gateway (via) or an interface (dev). Adding both is explicit and avoids ambiguity.

# Default route via a gateway
sudo ip route add default via 192.168.1.1 dev eth0

# Static route to a specific network
sudo ip route add 10.0.0.0/8 via 192.168.1.254 dev eth0

# Host route (single address, /32)
sudo ip route add 10.10.10.1/32 via 192.168.1.1

If a route for the same prefix already exists, add fails with RTNETLINK answers: File exists. The replace subcommand updates the existing route without requiring a delete first.

# Replace an existing default route
sudo ip route replace default via 192.168.1.254 dev eth0

Deleting a route requires matching the exact specification. If the route was added with a gateway and interface, the delete command should include them. If the optional attributes do not match, the kernel returns No such process .

# Delete a default route
sudo ip route del default

# Delete a specific static route
sudo ip route del 10.0.0.0/8 via 192.168.1.254

# Flush all routes on an interface
sudo ip route flush dev tun0

The flush command removes all routes associated with a given interface. This is useful when tearing down a VPN or virtual interface, but dangerous if applied to the primary interface .

c. Metrics, persistence, and verification

The metric argument controls route priority. When two routes match the same prefix, the kernel prefers the one with the lower metric. This is the mechanism for primary and backup gateways.

# Primary default route (low metric)
sudo ip route add default via 192.168.1.1 dev eth0 metric 100

# Backup default route (higher metric)
sudo ip route add default via 10.0.0.1 dev eth1 metric 200

The primary route is used as long as it exists. If eth0 goes down and its route is removed, the backup route becomes active . The kernel does not automatically detect a dead gateway on a link that is still up; that requires external monitoring.

Persistence follows the same pattern as ip addr. On NetworkManager systems, nmcli adds the route to the connection profile.

sudo nmcli connection modify "Wired connection 1" \
    +ipv4.routes "10.0.0.0/8 192.168.1.254"
sudo nmcli connection up "Wired connection 1"

On Netplan systems, the route is added to the interface’s YAML configuration and applied with netplan apply . After any change, ip route get verifies that the intended route is selected.

Complete Example Session

# ============================================
# PART 1: VIEW THE CURRENT ROUTING TABLE
# ============================================

ip route show
# default via 10.0.2.2 dev enp0s3 proto dhcp src 10.0.2.15 metric 100
# 10.0.2.0/24 dev enp0s3 proto kernel scope link src 10.0.2.15

# ============================================
# PART 2: CHECK WHICH ROUTE A DESTINATION USES
# ============================================

ip route get 8.8.8.8
# 8.8.8.8 via 10.0.2.2 dev enp0s3 src 10.0.2.15 uid 0

# ============================================
# PART 3: ADD A STATIC ROUTE
# ============================================

sudo ip route add 192.168.2.0/24 via 10.0.2.1 dev enp0s3
# No output on success.

# ============================================
# PART 4: VERIFY THE NEW ROUTE
# ============================================

ip route get 192.168.2.50
# 192.168.2.50 via 10.0.2.1 dev enp0s3 src 10.0.2.15 uid 0

# ============================================
# PART 5: ADD A BACKUP DEFAULT ROUTE WITH METRIC
# ============================================

sudo ip route add default via 10.0.2.3 dev enp0s8 metric 200
# The existing default (metric 100) remains preferred.

# ============================================
# PART 6: REPLACE THE DEFAULT ROUTE
# ============================================

sudo ip route replace default via 10.0.2.2 dev enp0s3
# Updates the existing default without a delete.

# ============================================
# PART 7: DELETE THE STATIC ROUTE
# ============================================

sudo ip route del 192.168.2.0/24 via 10.0.2.1
# Verify it is gone.
ip route show | grep 192.168.2.0

# ============================================
# PART 8: FLUSH ROUTES ON A VIRTUAL INTERFACE
# ============================================

sudo ip route flush dev tun0
# All routes associated with tun0 are removed.

# ============================================
# PART 9: PERSIST THE DEFAULT GATEWAY
# ============================================

sudo nmcli connection modify "Wired connection 1" \
    ipv4.gateway 10.0.2.2
sudo nmcli connection up "Wired connection 1"

The nine parts trace the lifecycle: viewing, diagnosing, adding, verifying, setting metrics, replacing, deleting, flushing, and persisting. The critical distinction is between the runtime command and the persistent configuration.

Quick Reference

ip route Commands

Command	Purpose
`ip route show`	List the main routing table
`ip route show default`	Show only the default route
`ip route get <dest>`	Which route would be used
`ip route add default via <gw> dev <if>`	Add a default route
`ip route add <prefix> via <gw>`	Add a static route
`ip route replace <prefix> via <gw>`	Replace an existing route
`ip route del <prefix>`	Delete a route
`ip route flush dev <if>`	Remove all routes on an interface

Route Types and Options

Option	Meaning
`via <gw>`	Next-hop gateway
`dev <if>`	Outgoing interface
`metric <n>`	Priority (lower wins)
`proto kernel`	Auto-added by kernel
`scope link`	Directly connected

Persistence Tools

Tool	System
`nmcli connection modify ... +ipv4.routes`	NetworkManager
Netplan YAML (`/etc/netplan/`)	Ubuntu
`systemd-networkd` `.network` files	systemd systems

Best Practices

✅ Do This:

ip route get 8.8.8.8
<!-- Verify the route before troubleshooting further --> # ✅

sudo ip route add 10.0.0.0/8 via 192.168.1.254 dev eth0
<!-- Specify both gateway and interface -->              # ✅

sudo ip route replace default via 192.168.1.254
<!-- Use replace instead of delete + add -->             # ✅

❌ Don’t Do This:

sudo ip route del default
<!-- On a remote system: kills all external connectivity --> # ❌

# Assume ip route add persists across reboot
<!-- Runtime-only; configure nmcli/Netplan -->           # ❌

sudo ip route flush dev eth0
<!-- Flushing the primary interface removes all routes --> # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Route lost after reboot	Runtime-only change	Configure with `nmcli` or Netplan
`RTNETLINK answers: File exists`	Route already present	Use `ip route replace`
`RTNETLINK answers: No such process`	Delete spec does not match	Check exact via/dev with `ip route show`
Traffic not using new route	Existing route with lower metric	Check `ip route get` and metrics
Cannot reach gateway	Interface down	`ip link set dev up`

Real-World Examples

1. Show Routing Table

ip route show

2. Query Route Decision

ip route get 8.8.8.8

3. Add Default Route

sudo ip route add default via 192.168.1.1

4. Add Static Route

sudo ip route add 10.0.0.0/8 via 192.168.1.254

5. Add Host Route

sudo ip route add 10.10.10.1/32 via 192.168.1.1

6. Replace Default

sudo ip route replace default via 192.168.1.254

7. Delete Route

sudo ip route del 10.0.0.0/8 via 192.168.1.254

8. Add Metric

sudo ip route add default via 192.168.1.1 metric 100

9. Flush Interface

sudo ip route flush dev tun0

10. Persist with nmcli

sudo nmcli con mod "eth0" +ipv4.routes "10.0.0.0/8 192.168.1.254"

Visual

Routing Decision Flow

┌──────────────────────────────────────────────┐
│  Packet to 8.8.8.8                           │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Longest prefix match in routing table       │
│                                              │
│  Is there a specific route?                  │
│  ├─ YES → use that gateway/interface         │
│  └─ NO  → use default route                  │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  ip route get 8.8.8.8                        │
│  → 8.8.8.8 via 192.168.1.1 dev eth0          │
└──────────────────────────────────────────────┘

The kernel matches the most specific prefix first. The default route is the fallback.

Metric Priority

┌──────────────────────────────────────────────┐
│  Default via eth0, metric 100 (primary)      │
│  Default via eth1, metric 200 (backup)       │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Kernel uses metric 100 while it exists      │
│  If eth0 route removed → metric 200 active   │
└──────────────────────────────────────────────┘

Lower metric wins. The backup is only used when the primary is absent.

Summary

Item	Value
Show routes	`ip route show`
Query decision	`ip route get <dest>`
Add default	`ip route add default via <gw>`
Add static	`ip route add <prefix> via <gw>`
Replace	`ip route replace`
Delete	`ip route del <prefix>`
Flush interface	`ip route flush dev <if>`
Metric	Lower value wins
Persistence	`nmcli`, Netplan, `systemd-networkd`

Key takeaways:

The default route is the fallback. It is used when no more specific prefix matches. Without it, only directly connected subnets are reachable .
ip route get is the diagnostic tool. It shows the exact next hop, interface, and source address the kernel would use for a destination .
replace avoids the delete-add cycle. If a route already exists, add fails with File exists. replace updates it in place.
Metric controls priority. When multiple routes match, the one with the lowest metric is chosen. This enables primary and backup gateways .
All changes are runtime-only. Persistence requires nmcli, Netplan, or systemd-networkd. The LFCS exam tests the runtime command and the knowledge that persistence is separate.

Remember: The routing table is the kernel’s decision map. ip route modifies it, ip route get queries it, and ip route show displays it. The default route is the last resort; specific routes override it. Metrics choose between competing routes. And every change is temporary until written to a network manager.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!