说明

iproute2里面的一个命令，ip rule 路由策略数据库管理命令
进行路由时，根据路由规则来进行匹配，按优先级（pref）从低到高匹配,直到找到合适的规则，所以在应用中配置默认路由是必要的
Internet上采用的路由算法一般是基于数据包目的地址的。
而在某些情况下，我们不只是需要通过数据包的目的地址决定路由，可能还需要通过其他一些域：源地址、IP协议、传输层端口甚至数据包的负载。这就叫做：策略路由(policy routing)。
注意：策略路由(policy routing)不等于路由策略(rouing policy)。路由_路由策略和策略路由有什么区别

在这种情况下，传统的基于目的地址的路由表就无法满足要求了，需要使用路由策略数据库(routing policy database,RPDB)代替，通过它选择执行某些路由。这些规则可以由很多不同的状态，而且它们没有天生的次序，要由系统管理员决定。
RPDB可以 匹配以下的域:

1. 数据包的源地址；
2. 数据包的目的地址；
3. 服务类型(Type of Service)；
4. 进入的网络接口；

匹配IP协议和传输层端口也是可能的，不过这要依靠iptables或者ipchains通过fwmark为某些数据包做标记，并重定向。
每个路由策略由一个选择符(selector)和一个操作(action)组成。系统按照顺序搜索路由策略数据库，把选择符和{源地址、目的地址、进入接口、tos、fwmark}等关键词进行匹配，如果匹配成功，就执行action定义的操作。操作或者成功返回，或者失败并且中止路由策略。否则，系统继续查询路由策略数据库。

操作如何定义？最原始的操作是选择下一跳(nexthop)和输出设备(output device)。Cisco IOS使用这种方式，我们姑且把这叫做匹配并设置(match & set)。而Linux的方式则更为灵活，Linux允许的操作包括：基于目的地址的路由表查询以及按照最长匹配的原则从路由表中选择路由。因此，匹配并 设置(match & set)的方式只是一个最简单的特例而已。
再系统启动时，内核会为路由策略数据库配置三条缺省的规则：

注：这里匹配任何条件就说明是按路由策略的优先级匹配各个路由表，如果没有匹配高优先级路由策略指定的路由表，就接着往下匹配，而不是说就直接进行丢弃了

不要混淆路由表和策略：规则指向路由表，多个规则可以引用一个路由表，而且某些路由表可以没有策略指向它。如果系统管理员删除了指向某个路由表的所有规则，这个表就没有用了，但是仍然存在，直到里面的所有路由都被删除，它才会消失。

参数

注：具体参数还是看系统命令，新版的iproute2里面又加了很多

**Usage: ip rule [ list | add | del ] SELECTOR ACTION （add 添加；del 删除； llist 列表）**

• SELECTOR := [ from PREFIX 数据包源地址] [ to PREFIX 数据包目的地址] [ tos TOS 服务类型][ dev STRING 物理接口] [ pref NUMBER ] [fwmark MARK iptables 标签]
• ACTION := [ table TABLE_ID 指定所使用的路由表] [ nat ADDRESS 网络地址转换][ prohibit 丢弃该表| reject 拒绝该包| unreachable 丢弃该包]
• [ flowid CLASSID ]
• TABLE_ID := [ local | main | default | new | NUMBER ]

可参数解析如下：
From — 源地址
To — 目的地址（这里是选择规则时使用，查找路由表时也使用）
Tos — IP包头的TOS（type of sevice）域
Dev — 物理接口
Fwmark — 防火墙参数

采取的动作除了指定路由表外，还可以指定下面的动作：
Table 指明所使用的表
Nat 透明网关
Prohibit 丢弃该包，并发送 COMM.ADM.PROHIITED的ICMP信息
Reject 单纯丢弃该包
Unreachable丢弃该包， 并发送 NET UNREACHABLE的ICMP信息

示例一

ip rule add from 192.168.1.112/32 [tos 0x10] table test2 pref 999 prohibit
#ip rule add to 192.168.1.2 pref 1000 table test1
#ip rule add from 192.168.1.0/24 pref 1001 table test1
#ip rule add [from 0/0] table test1 pref 1003
#ip rule add fwmark 1 pref 1002 table test2 此句型配合iptables -t mangle应用.如先对数据包作标记:
#iptables -t mangle -A PREROUTING -p tcp -m multiport —dports 80,8080,20,21 -s 192.168.1.0/24 -j MARK —set-mark 1

示例二

Source IP
根据来源端IP来决定数据包参考哪个路由表发送出去。以下两个示例分别指出，如果数据包的来源端IP是192.168.1.10，就参考路由表10；如果来源端IP为192.168.2.0/24网段的IP，就参考路由表20
ip rule add from 192.168.1.10 table 10 2 ip rule add from 192.168.2.0/24 table 20

Destination IP
根据目的端IP来决定数据包参考哪个路由表发送出去。以下两个示例分别指出，如果数据包的目的端IP是168.95.1.1，就参考路由表10；如果目的端IP是168.95.0.0/24网段的IP，就参考路由表20
ip rule add to 168.95.1.1 table 10 2 ip rule add to 168.96.0.0/24 table 20

ip rule show命令所显示内容的第一个字段就是优先级别，数字越小，代表优先级别越高，也代表这条规则可以排得越靠前

[root@localhost ~]# ip rule show  
0: from all lookup local  
32766: from all lookup main  
32767: from all lookup default  
[root@localhost ~]# ip rule add from 192.168.1.0/24 table 1 prio 10  
[root@localhost ~]# ip rule add from 192.168.2.0/24 table 2 prio 20  
[root@localhost ~]# ip rule show  
0: from all lookup local  
10: from 192.168.1.0/24 lookup 1  
20: from 192.168.2.0/24 lookup 2  
32766: from all lookup main  
32767: from all lookup default

删除规则

ip rule del prio 10
ip rule del from 192.168.1.0/24
ip rule del table 1
ip rule del from 192.168.1.0/24 table 1 prio 10

示例三

官方参考：http://www.man7.org/linux/man-pages/man8/ip-rule.8.html

IP-RULE(8)                          Linux                         IP-RULE(8)
NAME         top
       ip-rule - routing policy database management
SYNOPSIS         top
       ip [ OPTIONS ] rule { COMMAND | help }
       ip rule [ list [ SELECTOR ]]
       ip rule { add | del } SELECTOR ACTION
       ip rule { flush | save | restore }
       SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [
               fwmark FWMARK[/MASK] ] [ iif STRING ] [ oif STRING ] [ pref
               NUMBER ] [ l3mdev ] [ uidrange NUMBER-NUMBER ] [ ipproto
               PROTOCOL ] [ sport [ NUMBER | NUMBER-NUMBER ] ] [ dport [
               NUMBER | NUMBER-NUMBER ] ] [ tun_id TUN_ID ]
       ACTION := [ table TABLE_ID ] [ protocol PROTO ] [ nat ADDRESS ] [
               realms [SRCREALM/]DSTREALM ] [ goto NUMBER ] SUPPRESSOR
       SUPPRESSOR := [ suppress_prefixlength NUMBER ] [ suppress_ifgroup
               GROUP ]
       TABLE_ID := [ local | main | default | NUMBER ]
DESCRIPTION         top
       ip rule manipulates rules in the routing policy database control the
       route selection algorithm.
       Classic routing algorithms used in the Internet make routing
       decisions based only on the destination address of packets (and in
       theory, but not in practice, on the TOS field).
       In some circumstances we want to route packets differently depending
       not only on destination addresses, but also on other packet fields:
       source address, IP protocol, transport protocol ports or even packet
       payload.  This task is called 'policy routing'.
       To solve this task, the conventional destination based routing table,
       ordered according to the longest match rule, is replaced with a
       'routing policy database' (or RPDB), which selects routes by
       executing some set of rules.
       Each policy routing rule consists of a selector and an action
       predicate.  The RPDB is scanned in order of decreasing priority (note
       that lower number means higher priority, see the description of
       PREFERENCE below). The selector of each rule is applied to {source
       address, destination address, incoming interface, tos, fwmark} and,
       if the selector matches the packet, the action is performed. The
       action predicate may return with success.  In this case, it will
       either give a route or failure indication and the RPDB lookup is
       terminated. Otherwise, the RPDB program continues with the next rule.
       Semantically, the natural action is to select the nexthop and the
       output device.
       At startup time the kernel configures the default RPDB consisting of
       three rules:
       1.     Priority: 0, Selector: match anything, Action: lookup routing
              table local (ID 255).  The local table is a special routing
              table containing high priority control routes for local and
              broadcast addresses.
       2.     Priority: 32766, Selector: match anything, Action: lookup
              routing table main (ID 254).  The main table is the normal
              routing table containing all non-policy routes. This rule may
              be deleted and/or overridden with other ones by the
              administrator.
       3.     Priority: 32767, Selector: match anything, Action: lookup
              routing table default (ID 253).  The default table is empty.
              It is reserved for some post-processing if no previous default
              rules selected the packet.  This rule may also be deleted.
       Each RPDB entry has additional attributes. F.e. each rule has a
       pointer to some routing table. NAT and masquerading rules have an
       attribute to select new IP address to translate/masquerade. Besides
       that, rules have some optional attributes, which routes have, namely
       realms.  These values do not override those contained in the routing
       tables. They are only used if the route did not select any
       attributes.
       The RPDB may contain rules of the following types:
              unicast - the rule prescribes to return the route found in the
              routing table referenced by the rule.
              blackhole - the rule prescribes to silently drop the packet.
              unreachable - the rule prescribes to generate a 'Network is
              unreachable' error.
              prohibit - the rule prescribes to generate 'Communication is
              administratively prohibited' error.
              nat - the rule prescribes to translate the source address of
              the IP packet into some other value.
       ip rule add - insert a new rule
       ip rule delete - delete a rule
              type TYPE (default)
                     the type of this rule. The list of valid types was
                     given in the previous subsection.
              from PREFIX
                     select the source prefix to match.
              to PREFIX
                     select the destination prefix to match.
              iif NAME
                     select the incoming device to match. If the interface
                     is loopback, the rule only matches packets originating
                     from this host. This means that you may create separate
                     routing tables for forwarded and local packets and,
                     hence, completely segregate them.
              oif NAME
                     select the outgoing device to match. The outgoing
                     interface is only available for packets originating
                     from local sockets that are bound to a device.
              tos TOS
              dsfield TOS
                     select the TOS value to match.
              fwmark MARK
                     select the fwmark value to match.
              uidrange NUMBER-NUMBER
                     select the uid value to match.
              ipproto PROTOCOL
                     select the ip protocol value to match.
              sport NUMBER | NUMBER-NUMBER
                     select the source port value to match. supports port
                     range.
              dport NUMBER | NUMBER-NUMBER
                     select the destination port value to match. supports
                     port range.
              priority PREFERENCE
                     the priority of this rule.  PREFERENCE is an unsigned
                     integer value, higher number means lower priority, and
                     rules get processed in order of increasing number. Each
                     rule should have an explicitly set unique priority
                     value.  The options preference and order are synonyms
                     with priority.
              table TABLEID
                     the routing table identifier to lookup if the rule
                     selector matches.  It is also possible to use lookup
                     instead of table.
              protocol PROTO
                     the routing protocol who installed the rule in
                     question.  As an example when zebra installs a rule it
                     would get RTPROT_ZEBRA as the installing protocol.
              suppress_prefixlength NUMBER
                     reject routing decisions that have a prefix length of
                     NUMBER or less.
              suppress_ifgroup GROUP
                     reject routing decisions that use a device belonging to
                     the interface group GROUP.
              realms FROM/TO
                     Realms to select if the rule matched and the routing
                     table lookup succeeded. Realm TO is only used if the
                     route did not select any realm.
              nat ADDRESS
                     The base of the IP address block to translate (for
                     source addresses).  The ADDRESS may be either the start
                     of the block of NAT addresses (selected by NAT routes)
                     or a local host address (or even zero).  In the last
                     case the router does not translate the packets, but
                     masquerades them to this address.  Using map-to instead
                     of nat means the same thing.
                     Warning: Changes to the RPDB made with these commands
                     do not become active immediately. It is assumed that
                     after a script finishes a batch of updates, it flushes
                     the routing cache with ip route flush cache.
       ip rule flush - also dumps all the deleted rules.
              protocol PROTO
                     Select the originating protocol.
       ip rule show - list rules
              This command has no arguments.  The options list or lst are
              synonyms with show.
       ip rule save
              protocol PROTO
                     Select the originating protocol.
       save rules table information to stdout
              This command behaves like ip rule show except that the output
              is raw data suitable for passing to ip rule restore.
       ip rule restore
              restore rules table information from stdin
              This command expects to read a data stream as returned from ip
              rule save.  It will attempt to restore the rules table
              information exactly as it was at the time of the save. Any
              rules already in the table are left unchanged, and duplicates
              are not ignored.
SEE ALSO         top
       ip(8)
AUTHOR         top
       Original Manpage by Michail Litvak <mci@owl.openwall.com>
COLOPHON         top
       This page is part of the iproute2 (utilities for controlling TCP/IP
       networking and traffic) project.  Information about the project can
       be found at 
       ⟨http://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2⟩.
       If you have a bug report for this manual page, send it to
       netdev@vger.kernel.org, shemminger@osdl.org.  This page was obtained
       from the project's upstream Git repository
       ⟨https://git.kernel.org/pub/scm/network/iproute2/iproute2.git⟩ on
       2019-11-19.  (At that time, the date of the most recent commit that
       was found in the repository was 2019-11-17.)  If you discover any
       rendering problems in this HTML version of the page, or you believe
       there is a better or more up-to-date source for the page, or you have
       corrections or improvements to the information in this COLOPHON
       (which is not part of the original manual page), send a mail to
       man-pages@man7.org

/