Feature Request: Select routing table when tun.use_system_route_table is enabled (Linux)

Description

On Linux, Nebula’s tun.use_system_route_table: true controls how Nebula handles “unsafe routes” using the system routing tables. However, there is currently no option to specify which routing table Nebula should read from / consider when operating in this mode.

In multi-table routing setups (policy routing / per-host routing tables / BGP writing into a non-main table), Nebula can end up considering the wrong set of routes, leading to route conflicts - especially around 0.0.0.0/0 (default route).

Current behavior

With tun.use_system_route_table enabled, Nebula uses the system routing logic to deal with unsafe routes. The current implementation effectively relies on a default table (e.g., main/254) or scans broader route sets (depending on the current logic), without allowing the user to choose a specific routing table ID.

Desired behavior

Add an optional configuration parameter to allow the user to specify the routing table Nebula should operate on when tun.use_system_route_table is enabled.

Example:

tun:
  use_system_route_table: true
  system_route_table: 200

(Where 200 is the routing table ID used by the host’s routing policy.)

Motivation / Use case

I use BGP (bird) to sync routes into a custom routing table (e.g., table 200) on each node.

Topology example with 3 Nebula hosts: "A", "B", "C"

Bird on "B" and "C" send unsafe routes (including 0.0.0.0/0) to "A". "A" install routes into routing table 200. Nebula runs on A and has tun.use_system_route_table enabled.

Problem:

A also has a local default route in the main table. If Nebula considers unsafe routes from the main table (or a superset of tables), the default route from the main table can “compete” with the intended default route that exists in table 200, changing route selection / causing conflicts.

Expected outcome:

If Nebula is configured to operate (unsafe routes) only on routing table 200, then the unsafe routes seen/used by Nebula on "A" will include the defaults coming from "B" and "C" (in table 200), and the main-table default will no longer interfere.

Proposed config options

tun.system_route_table: <table_id> (numeric ID, e.g., 200) Optionally also support named tables (e.g., "main", "local")

Acceptance criteria

When tun.use_system_route_table is enabled, users can optionally set a specific routing table ID (e.g., 200). If the new option is not provided, behavior remains backward-compatible (current default behavior). Nebula’s unsafe route detection/handling is constrained to the configured routing table when specified. Document the new option in the configuration reference.

P.S.

This is my first GitHub issue, so I apologize in advance if the request is phrased awkwardly or is unclear. It was also drafted and translated with the help of AI, and I’m happy to revise it based on maintainers’ feedback.