Routing and default gateways on Linux

A Linux host’s routing table decides where every packet goes. A misconfigured table is one of the most common causes of “can reach local subnet, cannot reach anything else” symptoms.

The routing table

ip route show

Example output:

default via 10.0.0.1 dev eth0
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.10
192.168.1.0/24 via 10.0.0.5 dev eth0

Each entry has:

• A destination (a network or default).
• The action (via next-hop IP, or dev interface for directly-connected).
• The outgoing interface.
• Optional proto, scope, src, metric.

Read each field

How a route is chosen

The kernel uses the longest prefix match: the route with the most specific prefix wins. A /32 host route beats a /24 network route beats the default route.

ip route get simulates a lookup:

ip route get 8.8.8.8
ip route get 10.0.0.5
ip route get 192.168.1.42

This is the single most useful diagnostic for routing problems.

Default gateway

The default gateway is the route used when no more specific route matches. On a host with one interface, it is a single line in the routing table.

ip route add default via 10.0.0.1 dev eth0

A host must have exactly one default route (in the main table). Two defaults cause unpredictable behaviour - the kernel uses metric to break ties, but the result depends on order and may not be what you want.

Connected routes

When you add an address with ip addr add, the kernel automatically creates a connected route. Adding 10.0.0.10/24 to eth0 produces:

10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.10

This is why a host can reach other hosts in the same subnet without any explicit route - the kernel added one when the address came up.

Specific routes

ip route add 10.20.0.0/16 via 10.0.0.5 dev eth0
ip route add 192.168.50.0/24 via 10.0.0.6 metric 100
ip route add blackhole 10.30.0.0/16

A blackhole route silently drops traffic to a destination. Useful for blocking an internal subnet without firewall rules.

A prohibit route rejects traffic with an ICMP “communication administratively prohibited”.

ip route add prohibit 10.30.0.0/16

Multiple default routes

Sometimes a host has two uplinks (for redundancy) and needs two default routes. This is handled by:

• Different metrics: the lower metric wins; the higher metric is used only if the lower is down.
• Multipath routing: load-balances across both with the nexthop syntax.

ip route add default scope global nexthop via 10.0.0.1 dev eth0 nexthop via 10.0.1.1 dev eth1

This requires a kernel that supports multipath (default since 2.6). Use ip route get to verify the kernel is hashing across both paths.

IPv6 routing

Same commands, just with -6:

ip -6 route show
ip -6 route add default via fe80::1 dev eth0
ip -6 route get 2001:db8::1

The IPv6 default route is often added automatically via Router Advertisements. To set it explicitly, the gateway must be a link-local address (fe80::/10) on the same link, specified with the outgoing interface.

Diagnose “IP works but no internet”

Checklist:

1. ip addr show - is the interface up with an IP?
2. ip route show - is there a default route?
3. ip route get 8.8.8.8 - what does the kernel pick?
4. ip neigh show - is the gateway reachable at layer 2?
5. ping <gateway_ip> - can the gateway be reached?
6. ping 8.8.8.8 - can anything beyond the gateway be reached?

Each step isolates a layer. The most common failure is step 2

• no default route, often after a misconfigured Netplan or DHCP renewal.

Knowledge check