Default gateway

ip route shows it as default via 10.0.1.2. The gateway sees every packet the device sends off its network, so on a network you do not run, it is the first place your traffic can be read. DHCP usually hands it out.

How the default gateway works

Every time a machine sends an IP packet, its kernel looks the destination up in the routing table and picks the most specific route that matches: the longest prefix. A machine with the address 10.0.1.10/24 has two routes:

• 10.0.1.0/24, added by the kernel the moment the address was set: "this network is right here on eth0".
• default, which is 0.0.0.0/0: a prefix of length zero, so it matches every address, and loses to any route that is more specific.

So the decision for each packet is simple. Destination 10.0.1.11? It is inside the /24, so it goes straight to that machine. Destination 10.0.2.10, or any address on the internet? Only the default route matches, so it goes via the gateway, 10.0.1.2.

"Via" never changes the packet. The source and destination IP addresses stay 10.0.1.10 and 10.0.2.10. What changes is the Ethernet frame around it: the machine ARPs for the gateway's MAC address, not the server's, and sends the frame to the router. The router lowers the TTL by one, looks up its own table and sends a new frame on its next network. That is why the gateway must be a neighbour, an address inside a network the machine is directly on: it has to be reachable by ARP.

What it looks like on a Linux machine

In the bare machine lab a laptop starts with no address and no routes, and you add them one at a time. With an address but no default route, the kernel has nothing that covers the far network, and it says so before sending a single packet:

$ ip route get 10.0.2.10
RTNETLINK answers: Network unreachable

One command gives it the way out:

$ ip route add default via 10.0.1.2
$ ip route
default via 10.0.1.2 dev eth0
10.0.1.0/24 dev eth0 proto kernel scope link src 10.0.1.10
$ ip route get 10.0.2.10
10.0.2.10 via 10.0.1.2 dev eth0 src 10.0.1.10 uid 0
    cache

Now the far server answers with ttl=63: Linux starts packets at 64, and one router lowered it on the way back. traceroute -n 10.0.2.10 shows the gateway as hop 1 and the server as hop 2; to a neighbour on the same network there is no hop before the target. A DHCP client sets the same route for you: the router option (3) in the DHCP answer becomes default via, which the addresses and subnets lab and the home network lab both show.

What goes wrong, and how you see it

No default route. Neighbours work, everything else fails at once with "Network unreachable". Nothing leaves the card, so a capture stays empty.

A gateway that does not exist. The route is there, but the ARP for the gateway gets no answer. ip neigh shows the gateway FAILED, and ping reports Destination Host Unreachable from the machine's own address.

A gateway outside the subnet. ip route add default via 10.0.5.1 on a /24 in 10.0.1.x is refused with Error: Nexthop has invalid gateway. The kernel cannot ARP for an address that is not on the link.

A prefix too short. With /16 instead of /24, the far server looks local, so the machine ARPs for it directly and never uses the gateway. It is the same symptom as a dead gateway, with a different cause: ip route get shows no via.

A gateway that does not forward. A Linux box with net.ipv4.ip_forward = 0 answers ARP and pings to itself, but drops packets addressed beyond it. Traceroute stops after hop 1.

A gateway you do not trust. It sees every packet you send off your network. On a hotel or café network, that is the first place your traffic can be read or redirected; the hotel network lab shows it.

Questions people ask

Is the default gateway the same as the router? It is the router's address on your network. A router has one address per network it joins; your gateway is the one on your side.

Can a machine have two default gateways? It can hold two default routes with different metrics, and uses the lowest metric until that route is removed. It does not notice a gateway that silently dies. Networks that need a gateway to survive a failure share one virtual address between two routers with VRRP or HSRP, as in the first-hop redundancy lab.

How do I find my default gateway? On Linux, ip route show default. On Windows, ipconfig lists it as "Default Gateway"; on macOS, route -n get default.

See it on real machines