Help with understanding my routing table

[Steve Hoare]

Hi,

I'm running a RT-AC68U at home with the latest Merlin firmware.

I also confess I'm not an expert, especially on routing tables.

Mine is reproduced below and the query I have is that I don't recognise the purpose of the route or the IP which goes to address 31.24.226.234.

I'm running a VPN Server on the router and also connect to the router as a VPN client on several but not all machines on my network, i.e. split-tunnelled.

Other than that, the usual things, such as Trend Micro protection, DNS-O-Matic and Let's Encrypt for a SSL cert are in use.

Can anyone offer any insight into this route/IP as I'm a bit concerned having not recognised it...

Many many thanks in advance!!

 

[dave14305]

Are you in the UK? That IP address is. Check against your public IP address using whatismyip.com or similar tool. Are all the redacted IPs the same IP?

Do you see any static route entries in the LAN—Routes tab?

I don’t use VPN so your routing table is busier than mine.

 

[Steve Hoare]

Yes all the redacted IPs are the same, and yes I'm in the UK but that IP isn't my internet facing IP nor my VPN IP. Hope that helps...

And no Static LAN routes.

 

[ColinTaylor]

What type of internet connection do you have? PPPoE?

 

[Steve Hoare]

It's a PPPoE connection.

 

[ColinTaylor]

I am not very familiar with PPPoE but my guess is that it is your tunnel address.

Who is your ISP?

 

[RMerlin]

That IP belongs to UK2.net.

% Information related to '31.24.224.0/21AS13213'

route:          31.24.224.0/21
descr:          UK2.NET announcement
origin:         AS13213
mnt-by:         AS13213-MNT
created:        2015-10-14T14:15:30Z
last-modified:  2015-10-14T14:15:30Z
source:         RIPE

% This query was served by the RIPE Database Query Service version 1.92.6 (HEREFORD)

 

[ColinTaylor]

That IP belongs to UK2.net.

Yes, but they appear to be a web hosting company rather than an ISP which is a bit strange.

 

[Steve Hoare]

So, I've done a bit more digging and if I delete the route using route then it comes back on a reboot. It's also "hard coded" in the route file under /etc/proc. Think I got that path right but if not apologies..

However, it has to be associated with the VPN service I use as if I turn the client off then that route disappears. I use PIA but my public IP when I use that service is not the one I'm querying in my routing table.

Any ideas - keen to understand this and I can't say I do at the moment.

Thanks for all your help to date.

 

[ColinTaylor]

OK That's seems to make sense. It looks like that IP address is hosting one of PIA's UK servers.

C:\Users\Colin>nslookup uk-southampton.privateinternetaccess.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Non-authoritative answer:
Name:    uk-southampton.privateinternetaccess.com
Addresses:  31.24.226.237
          31.24.226.139
          31.24.226.229
          31.24.231.197
          31.24.226.140
          31.24.226.246
          31.24.226.189
          31.24.226.233
          31.24.226.218
          31.24.226.223
          31.24.226.220
          31.24.226.252
          31.24.226.209

 

[Steve Hoare]

Thank you all - that makes a lot of sense now, mystery solved!!