The router in depth
L3 mechanics and security: the routing table and administrative distance, packet processing, NAT/PAT types, default and floating routes, HSRP/VRRP, router hardening.
Lesson 1: The routing table in depth
Three route sources
Friday afternoon, half the company has no internet – and you are standing at the router, needing to read what it is doing right now and why it sends packets somewhere other than you expect. That is exactly what this course is for: looking under the router’s hood. And everything starts at its heart. The heart of a router is its routing table – a list of "to reach this network, go this way". Where do the entries come from? From three sources. (1) Connected – networks the router has directly attached to its interfaces (it knows them automatically). (2) Static – routes the admin enters by hand (the Routing and IP addresses course). (3) Dynamic – routes the router learns from a protocol like OSPF (the OSPF in depth course). Then for each packet the router looks in this table for where to send it.
Step by step
- Connected: networks on its own interfaces the router knows immediately, no config.
- Static: remote networks the admin adds by hand – "to 10.0.9.0/24 via R2".
- Dynamic: the rest the router learns from OSPF itself. Three sources, one table.
Administrative distance
What if multiple sources know a route to the same network – say the router hears it from OSPF and also has a manual static one? The router must decide whom to trust more. That’s what administrative distance (AD) is for – a trustworthiness number per source, where lower wins. A connected network has AD 0 (most trusted – I see it directly), static 1, OSPF 110, RIP 120. So if you have both a static (1) and an OSPF (110) route to the same network, the router uses the static one. AD is "who is right"; only then does the metric inside the protocol matter.
Step by step
- For 10.0.9.0/24 the router has two routes: static (AD 1) and from OSPF (AD 110).
- Lower AD wins → the router uses the static one (1 < 110). It keeps the OSPF one in reserve.
- Trust order: connected 0 → static 1 → OSPF 110 → RIP 120. The metric (cost) decides only within one protocol.
Longest prefix match
One more rule, and it’s the most important: when multiple routes in the table match a destination, the one with the longest prefix (longest prefix match) wins – the most specific network (the slash notation, e.g. /24, you know from subnetting in the ISO/OSI and TCP/IP course – a higher number = a narrower, more specific network). Example: you have a route to 10.0.0.0/8 (broad) and to 10.0.5.0/24 (narrow) and a packet heads to 10.0.5.10. Both "match", but the router picks /24 because it’s more specific. Note – this decision takes precedence over administrative distance (it is made first): the longest prefix is chosen first, and only among equal-length prefixes do AD and then the metric decide. That’s also why the default route (0.0.0.0/0, the shortest possible prefix) is used only when nothing more specific matches.
Step by step
- Three routes match 10.0.5.10: /8, /24 and the default /0. Which to pick?
- /24 wins – the longest (most specific) prefix. /8 and the default are too broad.
- Decision order: longest prefix first, then (among equals) AD, then metric. The default is the last resort.
Lesson 2: How a router processes a packet
Lookup and next hop
What does a router physically do with a packet? The packet arrives on an interface. The router looks at the destination IP, finds the best route in the table (longest prefix) and from it the next hop and the outgoing interface. Then it rewrites the packet at Layer 2: rewrites both MACs (the physical address for the local network, from the How networks work course; new source = its outgoing interface, new destination = the next-hop’s MAC), decrements TTL by 1 and sends it out. The IP addresses stay (who→whom doesn’t change, only the MAC at each hop). The router repeats this hop by hop until the packet reaches the destination.
Step by step
- The packet arrives. The router reads the destination IP and finds the best route (next hop) in the table.
- It rewrites the L2 header: new destination MAC = next hop, decrements TTL by 1. The IPs stay.
- It sends the packet out the right interface. And this repeats hop by hop to the destination.
ARP for the next hop
Wait – the router knows the IP of the next hop, but at Layer 2 it needs its MAC. How does it get it? ARP (Address Resolution Protocol): the router asks on that network by broadcast "who has IP 10.0.2.1?", the owner replies "me, and here’s my MAC". The router stores the IP→MAC pair in its ARP cache (for next time) and only now fills in the destination MAC and sends the packet. That’s why the first packet to a new next hop briefly "waits for ARP". This small detail joins the L3 decision (where) with L2 delivery (to whom physically).
Step by step
- The router knows the next hop’s IP but not its MAC. It sends an ARP request: "who has this IP?".
- The owner replies with its MAC. The router stores the IP→MAC pair in its ARP cache.
- Now it fills in the destination MAC and sends the packet. Next time it doesn’t ask – it’s in the cache.
When there’s no route
And what if the router has no route for the destination (neither specific nor default)? It can’t send the packet "nowhere" – so it drops it. A well-behaved router then sends the sender back an ICMP "destination unreachable" ("I can’t deliver this"). A packet is likewise dropped when its TTL expires (reaches 0) – this protects against forever-circling in a loop and generates "time exceeded" (which traceroute relies on). A drop isn’t a router fault – it’s the correct reaction to a missing route or a loop.
Step by step
- The packet heads to 8.8.8.8, but the router has no route for it (not even a default). Now what?
- The router drops the packet and sends the sender ICMP "unreachable" – "I can’t deliver this".
- A packet whose TTL expires (a loop) ends the same. The drop is correct – it protects the network.
Lesson 3: NAT and PAT in depth
Static NAT (1:1)
Routers often also do NAT (address translation) – from the Routing and IP addresses course you know it hides a private network behind a public IP (in the simulator NAT is done by the edge device – router or firewall; manual DNAT/static NAT is configured on the firewall). Now in detail, by type. Static NAT is a fixed 1:1 mapping: one private IP ↔ one public, permanently. It’s useful when an internal server must be permanently reachable from outside at a fixed public address (and also goes out under the same one). It’s predictable, but "consumes" one public IP per server.
Step by step
- Static NAT: server 10.0.0.20 has the public 203.0.113.20 permanently assigned.
- Anyone from the internet hits 203.0.113.20 → the router translates to 10.0.0.20. The server is always reachable.
- It’s 1:1 permanent – predictable, but consumes one public IP per server. Try it in the task “Expose a server from outside (static NAT 1:1)” – in the simulator.
Dynamic NAT and PAT
Public IPs are scarce, and a home/company has dozens inside. Dynamic NAT assigns private addresses a public one from a pool (first come), but still needs as many publics as there are devices communicating at once. The solution everyone uses: PAT (Port Address Translation) / NAT overload – all inside hosts share one public IP, and the router tells them apart by source port. PC-A:50000 and PC-B:50000 both go out as 203.0.113.1, but with a different assigned port; by it the router returns replies to the right one. This is how thousands of devices hide behind one public IP.
Step by step
- PC outbound: source 10.0.0.10:50000. A private address can’t go on the internet.
- PAT rewrites the source to the public IP + an assigned port (203.0.113.1:40001) and records the pair.
- The reply comes to port 40001 → the router knows it’s the PC’s. Thousands of devices behind one IP.
Port forwarding and hairpin
PAT handles the way out. But what if an inside server should accept connections from outside? From outside there’s no one to reply to – the router doesn’t know which inside host to give it to. Hence port forwarding (static PAT / DNAT): you set a rule "inbound to public IP:443 redirect to 10.0.0.20:443". This exposes one inside port to the world (exactly what the simulator task does). A special case is hairpin NAT: an inside client wants to reach its own server via its public IP (say, by typing the domain). But the public address is not on the local network, so the packet heads to the gateway – and the router has to "turn it back" inside.
Step by step
- A connection arrives from the internet to public IP:443. Which inside host to give it to? The router can’t tell by itself.
- Port forwarding: a rule ":443 → 10.0.0.20:443". Now the router knows where to send it. The server is reachable from outside.
- Hairpin: even an inside PC reaching the server via its public IP goes through the router and "turns back" inside.
Lesson 4: Ways out and backups
The default route
You can’t hold the whole internet in the table (millions of networks). Hence the default route (0.0.0.0/0) – "whatever I don’t recognize, send here" (typically to the ISP). It’s the shortest possible prefix, so it’s used last of all, when nothing more specific matches (longest prefix from lesson 1). It’s also called the gateway of last resort. For end ("stub") networks with only one way out, a single default route suffices instead of thousands of entries.
Step by step
- The router knows internal networks. But the internet (millions of nets) won’t fit. What about an unknown destination?
- Default route 0.0.0.0/0 → to the ISP. The unknown goes here. One entry instead of the whole internet.
- It’s used last (shortest prefix). For stub networks with a single way out it’s all you need.
Floating static (backup)
You want a backup: the main path via R1, and if it fails, let it go via R2. The trick is a floating static route – a backup static route with an artificially raised administrative distance. The main route has, say, AD 1, the backup you set to AD 5. As long as the main lives (lower AD), the router uses only it; the backup "floats" outside the table. As soon as the main disappears (typically its interface goes down or its next-hop stops being reachable – a static route has no "heartbeat" of its own), the backup pops into the table and traffic flows via R2. It’s a simple backup without a dynamic protocol – cheap and predictable.
Step by step
- Main path via R1 (AD 1). The backup via R2 has a higher AD 5 → unused for now.
- R1 fails. The main route (AD 1) disappears from the table.
- The floating static (AD 5) pops into the table and traffic flows via R2. A backup without dynamic routing.
Stub vs transit router
When is a default enough and when not? It depends on the router’s role. A stub (edge) router has only one way out and only "its own" networks behind it – a default route is plenty (send everything unknown out). A transit router, by contrast, connects several networks together and traffic flows through it in various directions – it must know specific routes to all those networks (a default would send everything one way and miss the rest). Same box, different role = different demands on the table. So a large network combines a default (at the edge) with dynamic routing (inside).
Step by step
- Stub router: one way out, its own networks behind it. A default route is plenty.
- Transit router: connects several networks, traffic flows in various ways. A default isn’t enough.
- So you combine: default at the edge, dynamic routing (OSPF) inside. The role drives the table.
Lesson 5: First-hop redundancy
The single-gateway problem
End devices have one default gateway in their settings (one router IP). But that’s a single point of failure: when that router fails, the whole network loses its way out – even if a second, backup router stands right next to it. Because clients only know that one IP, and rewriting it by hand on hundreds of PCs isn’t feasible. We need two routers to appear as one gateway to the outside and quietly take turns between themselves. That’s exactly what FHRP (First-Hop Redundancy Protocol) solves – next module (HSRP/VRRP).
Step by step
- The PC has one gateway set = R1’s IP. All outbound traffic goes via R1.
- R1 fails → the PC loses its gateway. R2 is right there, but the PC doesn’t know its IP. Rewrite hundreds of PCs by hand? No.
- We need two routers to appear as one gateway and back each other up. That’s FHRP – next module.
HSRP and VRRP
HSRP (and its open-standard counterpart VRRP) turns two routers into one virtual gateway. It creates a virtual IP and a virtual MAC that clients get as their default gateway – and they have no idea two physical routers stand behind it. One is active (forwards traffic), the other standby (waits). Who is active is decided by priority (the higher number wins). Both send short hellos; when the active goes quiet, the standby takes over within a few seconds the same virtual IP and MAC. For clients nothing changed – the gateway "is still the same". A router failure without a network outage.
Step by step
- R1+R2 share a virtual IP+MAC 10.0.0.1. R1 is active (forwards), R2 is standby.
- The PC has that virtual IP as its gateway. It has no idea there are two routers – it talks "to the gateway".
- R1 fails → R2 takes over within seconds the same virtual IP+MAC. For the PC nothing changed. No outage.
Load sharing and three redundancies
HSRP/VRRP have one "shortcoming": the standby router just waits and does nothing – wasteful. There are variants that can also balance the load across both gateways (e.g. GLBP): client traffic is split (in practice GLBP has one virtual IP gateway but hands clients different virtual MAC addresses – so different clients reach different physical routers) so both routers work at once, and if one fails the other takes over. But don’t confuse it: this is redundancy of the first gateway (where I send a packet out of my network) – different from redundancy of the path inside (OSPF from the OSPF in depth course) or redundancy of the link at L2 (STP from the Redundancy and Spanning Tree course). Each layer has its own backup; together they keep the network up.
Step by step
- With HSRP the standby just waits. The second router goes unused. A waste of capacity.
- GLBP splits traffic → both routers forward at once, and if one fails the other takes over.
- Don’t confuse three redundancies: gateway (FHRP), path (OSPF), link (STP). Each a different level.
Lesson 6: Router security
Control plane vs data plane
For router security it’s key to distinguish two planes. The data plane = transit traffic that merely flows through the router from one network to another. The control plane = the router’s own processes: routing protocols (OSPF), management (SSH), ARP… i.e. traffic aimed at the router. Why separate them? Because an attack on the control plane (flooding the router with fake OSPF/ARP/management packets) can take down its "brain", even if the data plane would otherwise handle the traffic. The defense is called CoPP (Control Plane Policing) – it limits how much traffic may reach the control plane so no one can overwhelm it.
Step by step
- Data plane: traffic merely flows through the router (PC → internet). That’s its everyday job.
- Control plane: traffic for the router itself – its "brain" (routing protocols, management).
- An attack floods the control plane with fake packets → the router "freezes". Defense: CoPP limits traffic to the brain.
ACLs on the interface
The most common filter on a router is an ACL (Access Control List) – a list of "permit/deny" rules by source, destination, protocol and port (you know it from the Switching and VLANs and Network security courses). But on a router it matters where and which way you apply it: an ACL is attached to a specific interface and a direction – in (traffic coming into the interface) or out (leaving out). The same rules on the wrong direction catch nothing, or block what they shouldn’t. A practical rule (for extended ACLs, which also match destination and port like here): filter as close to the source as possible (drop unwanted traffic early so it doesn’t needlessly cross the network). And remember – at the end of an ACL there’s a hidden "deny all".
Step by step
- You attach an ACL to a specific interface and direction: in (into the interface) or out.
- Practical rule: filter as close to the source as possible – drop unwanted traffic early.
- And note: at the end of an ACL is a hidden "deny all". What no rule permits falls through and is blocked.
Anti-spoofing and secure management
Let’s finish router hardening. Anti-spoofing: an attacker likes to forge the source IP to hide or slip past a filter. uRPF (Unicast Reverse Path Forwarding) catches it – for an incoming packet it checks whether the router would send a reply back the same way to that source IP; if not, it’s likely a forgery and the packet is dropped. And secure management: log into the router only encrypted via SSH (never Telnet – it sends the password in clear), use strong login (AAA) and disable unused services. A router is the network’s gateway and brain – whoever controls the router controls the traffic.
Step by step
- The attacker sends a packet with a fake source IP (to hide / bypass a filter).
- uRPF checks: would I send a reply to that source IP back the same way? If not → a forgery, drop.
- And manage the router only via SSH (not Telnet – it sends the password in clear), with strong login. The router controls all traffic.
Lesson 7: The router in practice and synthesis
VRF: separate tables
An advanced trick: VRF (Virtual Routing and Forwarding). One physical router can hold several separate routing tables at once – as if it became several independent virtual routers. Traffic in one VRF knows nothing about the others, even when they use the same IP ranges. Uses: a provider serves many customers on one router without them seeing into each other’s networks; or a company separates, say, the operations network from the camera network. It’s segmentation at L3 – the counterpart of what VLANs do at L2.
Step by step
- One physical router. Normally it has one routing table for everything.
- With VRF it holds several separate tables – here VRF-A and VRF-B with the same range, and they can’t see each other.
- It’s L3 segmentation – many customers/networks on one router with no mutual access. The VLAN counterpart.
Monitoring and logging
For a network to be manageable and tunable, a router can report on itself. SNMP collects state and metrics (interface load, CPU, outages) into central monitoring. Syslog sends event logs (who logged in, what failed) to a log server – ideally into the SIEM from the Advanced security course. And NetFlow reports who talked to whom and how much (flows), useful for capacity and security analysis (unusual flows = suspicion). Without monitoring you’re blind in the network: you don’t know what’s happening until it breaks. This is everyday operational reality.
Step by step
- The router reports state and logs (SNMP, Syslog) to central monitoring – ideally a SIEM.
- NetFlow reports flows – who with whom and how much. For capacity and security (an unusual flow = suspicion).
- Without monitoring you don’t know what’s happening until it breaks. So it’s an operational necessity.
The complete router and what’s next
Let’s sum up the router in depth. We dissected the routing table (connected/static/dynamic, administrative distance, longest prefix), how a router processes a packet (next hop, ARP, TTL, ICMP), NAT/PAT types and port forwarding, default and floating routes, first-hop redundancy (HSRP/VRRP), and security (control vs data plane, ACL, uRPF, SSH, VRF, monitoring). A router is the network’s crossroads and brain – and now you know how it decides and how to protect it. That completes the whole per-device deep dive (switch → router → firewall) and the full picture of a modern network.