Connected, static and default routes

Three route types account for ninety percent of the routes on a production OPNsense firewall: connected routes, static routes, and the default route. The default route is technically a static route — a route to 0.0.0.0/0 — but it is so important that operators treat it as its own category. Understanding when each is created, how each behaves, and how each fails is the difference between “this is a five-minute fix” and “this is an all-night incident”.

Connected routes

When you assign 192.0.2.10/24 to interface igb0, FreeBSD installs two routes automatically:

• 192.0.2.0/24 link#1 U ... igb0 — the network route. Any packet to 192.0.2.0–192.0.2.255 matches this and is sent directly on igb0 via ARP.
• 192.0.2.10 link#1 UHS ... lo0 — the host route. A more specific /32 route that points traffic destined for the firewall’s own IP at the loopback interface. Without this, the kernel would not be able to deliver local-originated packets back to itself.

$ ifconfig igb0 | grep inet

	inet 192.0.2.10 netmask 0xffffff00 broadcast 192.0.2.255
inet6 fe80::aa:bb:cc:dd:ee:ff%igb0 prefixlen 64 scopeid 0x1

You cannot delete connected routes from the OPNsense GUI. The only way to remove them is to remove the IP from the interface or disable the interface. This is intentional — connected routes are how the kernel knows what is directly reachable without a gateway.

Static routes

A static route is a manually-configured entry that tells the firewall “send traffic for this destination to this gateway via this interface”. On OPNsense the GUI path is System → Routes → Configuration. The fields the operator fills in are:

• Destination network — the prefix the route applies to, in CIDR notation (203.0.113.0/24).
• Gateway — the next-hop IP the firewall will ARP and send frames to.
• Interface — which interface the gateway is reachable on (chosen by the GUI from the gateway’s definition).

A static route becomes a route add invocation on the underlying shell when OPNsense applies the configuration. To verify the route is in the FIB, run netstat -rn and look for a UGS flag set (Up, Gateway route, Static).

$ route -n show 203.0.113.0/24

   route to: 203.0.113.0
destination: 203.0.113.0
     mask: 255.255.255.0
  gateway: 198.51.100.1
interface: igb1
    flags: <UP,GATEWAY,DONE,STATIC>
recvpipe  sendpipe  ssthresh  rtt,msec    mtu        expire
 0         0         0         0         1500        0

Static routes have a strict precedence rule: a more-specific prefix always wins over a less-specific one. The static 203.0.113.0/24 route wins over a default route 0.0.0.0/0 for any destination in 203.0.113.0/24. That is why static routes are the right tool for “send this particular subnet via this particular gateway, but use the default for everything else”.

The default route

The default route is a static route to 0.0.0.0/0 (IPv4) or ::/0 (IPv6). It is the catch-all: every destination that no other route matches uses the default route. On OPNsense the default route is implicitly created from the gateway assigned to the WAN interface under Interfaces → [WAN]. If no gateway is configured, there is no default route, and traffic to non-connected destinations is dropped.

The default route is a single route in the FIB, but in multi-WAN deployments the OPNsense GUI shows a “gateway group” abstraction that the firewall translates into multiple default routes with different priorities. The lesson on policy routing covers this in detail; for now, the production rule is:

Every OPNsense firewall that talks to the Internet needs a default route. If netstat -rn does not show a default line, every Internet-bound packet is dropped.

Choosing between default and more-specific routes

A static route to a particular subnet is almost always preferable to a default route when:

• That subnet has a different upstream than the rest of the Internet. Example: a partner network reachable via a dedicated VPN tunnel with a known next hop.
• You want to keep traffic to that subnet out of a multi-WAN load balance. (Multi-WAN load balances across all default routes; a more-specific static route can pin traffic to a single gateway.)

A default route is the right choice for:

• “Everything else goes here” — the Internet, generally.
• A single-WAN deployment with no special paths.
• Fallback behaviour after more-specific routes fail.

The mistake is configuring a default route when you meant a more-specific route, or vice versa. A default route that points at the wrong ISP gateway causes all Internet traffic to misroute; a more-specific static route that catches one subnet misdirects only that subnet.

Production failure modes

Three failure modes occur repeatedly:

1. Static route added but not in the FIB. The GUI accepts the route but netstat -rn does not show it. Causes: typo in the gateway IP, the gateway’s interface is down, or a more-specific dynamic route from FRR is winning. Diagnose with route -n show <prefix>.
2. Static route works until reboot. A route that was added by hand at the shell with route add is not in the config XML and disappears on reboot. Re-add via the GUI.
3. Connected route gone after an interface change. Re-assigning an interface IP can transiently remove the connected route while the new address is configured. In a CARP failover or a config apply, this can cause a few seconds of packet loss for the affected subnet. Plan maintenance windows around interface changes.

Summary

• Connected routes are automatic and exist for as long as the interface has an IP. The host route (/32) for the firewall’s own IP is also a connected route.
• Static routes are configured at System → Routes → Configuration and persist in the config XML.
• The default route is the static route to 0.0.0.0/0. Without it, every Internet-bound packet is dropped at the IP layer before PF sees it.
• netstat -rn and route -n show <prefix> are the verification commands. If the route is not in the FIB, the firewall will not use it.