How Mac OSX Prioritizes Network Interfaces When Routing

ifconfigmacosnetstatnetworking

To give a concrete example, how does OSX choose which of these default entries from netstat -nr to route to? 

Destination        Gateway            Flags        Refs      Use   Netif Expire
0/1                10.10.99.100       UGSc            0        0    ppp0
default            192.168.1.1        UGSc            5        0     en0
default            192.168.1.1        UGScI           1        0     en1
default            192.0.2.1          UGScI         157        2    ppp0

From what I have been able to tell OSX uses metrics on its interfaces rather than on its routing table entries. But by default all of those interface metrics are 0 so how does it choose? Last created interface?

I've seen some folks suggest its the order in the Network preferences, but in my case the ppp0 interface (from SonicWall NetExtender) isn't listed there.

There is some discussion in this thread, but no answer that I see.

Best Answer

Most systems follows these rules when choosing which route to use:

  • Find the most specific ones (i.e. the ones with the longest matching prefix).
  • Choose the one with the highest priority.

On Linux (and, I think, on Windows) priority is determined by metric, but it is not the case on macOS as you correctly pointed out. Instead of assigning metrics to individual routes, macOS assigns priorities to interfaces. You can use networksetup -listnetworkserviceorder to view this order and networksetup -ordernetworkservices to change it.

Now, this route from your output makes me think that in your case specificity also plays its role:

Destination        Gateway            Flags        Refs      Use   Netif Expire
0/1                10.10.99.100       UGSc            0        0    ppp0

This route covers the bottom half of the address space and therefore I would expect to also find:

128.0/1            10.10.99.100       UGSc            0        0    ppp0

in your routing table. This is a standard trick VPN software uses to prioritise its routes over default: it adds two routes which together cover all IP addresses, but each of them is more specific than default, so they win.

Related Question