Skip to content

The Routing Table

Time: 60 min

Needs: one OL9 Router, one OL9 PC, 2 VPCS and two Ethernet switch

GNS3 project: w04-a1-routing-table

Info

Times listed are approximate and provided as timing guidelines only. Take as much time as you need to complete the activity.

Question

How does a host on a LAN reach arbitrary destinations on the internet whilst knowing nothing about where they are located?

Build it

  LAN1 192.168.100.0/24      10.0.0.0/29

  PC1 ─── SW1 ─── R1 ───────────
  .10             .1  10.0.0.1

R1 is an OL9 Router, PC1 an OL9 PC, and SW1 a plain Ethernet switch — the LAN needs one, even with a single host on it. Nothing is cabled to R1:eth1; the subnet on it exists purely to be somewhere PC1 is not attached.

Log on to R1 as root, then: 

nmcli con add type ethernet ifname eth0 con-name eth0
nmcli con add type ethernet ifname eth1 con-name eth1

nmcli con mod eth0 ipv4.method manual ipv4.addresses 192.168.100.1/24
nmcli con mod eth1 ipv4.method manual ipv4.addresses 10.0.0.1/29

nmcli con up eth0
nmcli con up eth1

sysctl -w net.ipv4.ip_forward=1

Log on to PC1 as root, then: 

nmcli con add type ethernet ifname eth0 con-name eth0 \
    ipv4.method manual ipv4.addresses 192.168.100.10/24

nmcli con up eth0

Predict first

  1. Without routing, PC1 can only reach its neighbors. How does PC1 determine who is a neighbor? ___
# On PC1
ip route show
  1. Can it reach 192.168.100.50? ___
  2. Can it reach 10.0.0.1? ___

Start a capture on PC1 cable.

# On PC1
ping -c1 192.168.100.1
ping -c1 10.0.0.1

What just happened

  • PC1's routing table has only one entry. The entry was auto-generated. When you assign an address to an interface, you make an implicit claim that the whole subnet the address is part of can be reached out of that interface, and the kernel records that claim as a route.
  • The /24 defines the subnet. It identifies the leading 24 bits in the address as the subnet previx. That maps to the three octets 192.168.100 (the dots mark byte boundary)
  • The address 192.168.100.0/24 is special. It is the first address in this subnet and it is used in routing as the address of the whole subnet.
  • The ping to 192.168.100.1 succeeded because it sits withing PC1's subnet.
  • The ping to 10.0.0.1 failed. The reason given was Network is unreachable and PC1 put nothing on the wire, not even ARP (verify that in Wireshark), because the error came from PC1's own kernel
    • It didn't matter that 10.0.0.1 is owned by a host on the same LAN. PC1 instantly determined the address to be on a different subnet, and finding no matching route to try, gave up.

Do this — add a route

# on PC1
ip route add 10.0.0.1 via 192.168.100.1
ip route show
ping -c1 10.0.0.1

What just happened

  • PC1 now has a route to a destination outside its subnet, and the ping succeeds.

Do this - LAN2

  • Drag a second Ethernet Switch on to the canvas, named it SW2, and cable R1:eth1 to it
  • Connect two VPCS to SW2
  • Start a capture on R1-SW2 cable

On PC2 / PC3: 

ip 10.0.0.2/29      # .3

On PC1: 

ping -c1 10.0.0.1
ping -c1 10.0.0.2

The ping to 10.0.0.2 fails. Let's add a route to it:

On PC1: 

ip route add 10.0.0.2 via 192.168.100.1

ping -c1 10.0.0.2

There is no error this time, and Wireshark shows the packet was delivered, but there is no answer.

On PC2: 

ip 10.0.0.2/29 10.0.0.1

On PC1: 

ping -c1 10.0.0.2
ping -c1 10.0.0.3

What just happened

  • There were a couple of failures, and each had a different cause:
    • The first ping failed because PC1 had no route to PC2, so we add the route
    • The second ping was duly delivered to PC2 but it had no route back to PC1, so it stayed silent. PC1 waited for an answer that never came and eventually gave up waiting.
    • The solution to the second failure was to tell PC2 to use R1 as its gateway. More on that in the next section.
  • The ping to PC2 now succeeds, but PC3 fails. We can add a route to it, but that would mean adding an entry to PC1 routing table each time LAN2 gain a host, not to mention you would need to do that for each host that joins LAN1 as well. This is what network addresses exist to solve.

The power of 2 rule

IPv4 subnet sizes are calculated as \(size = n^2\), where n is the number of host bits. This is 32 minus the prefix length.

So, for /29, the numbers break down as follows:

  • Prefix length: \(29\)
  • Host bits: \(32 - 29 = 3\)
  • size: \(2^3 = 8\)

This also means that the first address in any subnet must land on a power of 2 and must be a multiple of the subnet size. More on this in the next module.

Do this - Use the network ID

On PC1: 

ip route del 10.0.0.1
ip route del 10.0.0.2

ip route add 10.0.0.0/29 via 192.168.100.1
ip route show

On PC3: 

ip 10.0.0.3/29 10.0.0.1

On PC1: 

ping -c1 10.0.0.2
ping -c1 10.0.0.3

What just happened

  • Instead of routes to individual hosts, we now have one route for the entire LAN2, identified using the address 10.0.0.0/29. This is called subnet ID or network ID and every subnet has one. It is always the first address in the range, and it is reserved, i.e. cannot be assigned to an interface.
  • At this point, PC1 can reach every host within LAN1 and LAN2, and nothing more.

Do this - Make it global

On PC1: 

ip route del 10.0.0.0/29

ip route add default via 192.168.100.1
ip route show

What just happened

  • Instead of a specific route, we added a catch-all route, known as the default route. This means PC1 can now attempt every destination in the world without having to be told about specific subnets.
  • A default route (a.k.a default gateway) makes no claim about whether the destination exists. It just tells you where to send packets whose destination is unknown. Every failure from here is somewhere else's problem.

Do this — how decisions are made

On R1: 

ip addr add 192.168.100.2/24 dev eth0
ip addr add 192.168.100.3/24 dev eth0
ip addr show eth0

Multiple addresses for one interface

An interface is not limited to one address. R1:eth0 now answers to three different addresses. This can be useful in a couple of scenarios:

  • one server hosting several services that each need their own address rather than sharing one
  • renumbering — a router holding the old and the new gateway address simultaneously, so that hosts can move across a few at a time instead of all at the instant of the change.
  • a management address kept apart from the service address, so that the server stays reachable when the service address moves elsewhere

On PC1 

ip route get 192.168.100.50
ip route get 10.0.0.2
ip route get 8.8.8.8

ip route add 10.0.0.0/24 via 192.168.100.2
ip route get 10.0.0.2

ip route add 10.0.0.0/29 via 192.168.100.3
ip route get 10.0.0.2

ip route get 10.0.0.9
ip route show match 10.0.0.2
ip route show

What just happened

  • We used ip route get to ask the router how it would decide what to do given a concrete destination. The decision consists of a next hop, an outgoing interface and a source address.

    • The next hop indicates a direction and makes not claim about the outcome
    • The routing table's answer does not report which entry produced the decision

  • Look at the 10.0.0.2 decision. ip route show match 10.0.0.2 showed three candidate routes, and the one that won was the most specific — /29 is more specific that /24.

    • This mechanism matters for flexibility. It lets you define a broad routing statement and a narrow exception at once, with no conflict.