# Routing in DCO

When OpenVPN is operating in multi-peer mode it requires a way to understand
which peer outgoing packets should be forwarded to.

If DCO is not enabled, OpenVPN creates an internal mapping where specific destinations
are associated with specific peers. This mapping is created following the `--iroute` and
`--iroute-ipv6` directives configured by the user.

With DCO there is no access to any mapping in userspace, therefore DCO must come up with
its own solution.

## Linux

On Linux DCO simply relies on the system routing table to tell it which peer is responsible
for a destination.

Specifically, DCO looks up the destination adress in the main system routing table and uses the
nexthop IP to match the responsible peer.

Example:
```
100.100.0.0/24 via 10.10.0.5 dev ovpn0
```
This route entry tells DCO that any packet going to `100.100.0.0/24` should be sent to the peer having VPN IP 10.10.0.5.
The matching between the VPN IP and the actual peer instance is performed internally to DCO.

One of the benefit give by this approach, is that any component external to OpenVPN may add or remove VPN routes
without directly interacting with OpenVPN. Think about external routing daemons or other processes listening to
link notifications.

### Userspace

Due to the logic described above, OpenVPN in userspace has been adapted to add such routes when the user specifies any
`--iroute` or `--iroute-ipv6`.