The default gateway is the address a device sends traffic to when the destination is not on its own network. Every host checks whether a destination is local, then looks for a matching route. When nothing matches, the packet goes to the gateway, which is a router that knows more about other networks than the host does.
- Written as 0.0.0.0/0, the least specific route possible
- It must be on the same subnet, because reaching it cannot be routed
- The frame carries the far host IP and the router MAC address
- A wrong subnet mask means the gateway is never consulted at all
- A VPN adds a second one, which is how full tunnel mode works
On this page
The decisionWhat a device does with every packet
The decision happens for every packet leaving a host on the network, and it takes two steps before the default gateway is even considered.
First, is this destination on the local network? The device compares the destination address with its own address and subnet mask. If the network portion matches, the destination host is on the same network, and the packet is delivered directly using ARP to find its hardware address. No router is involved at all.
Second, if it is on another network, which route matches? The device consults its routing table, looking for the most specific route covering that destination. If one exists, the packets go to whichever gateway the route names.
If nothing matches, the default route is used. That route is written as 0.0.0.0/0, which matches every address in existence and is therefore the least specific route possible. Because networking devices always prefer the longest match, the default route only wins when nothing else applies, which is exactly what the word means.
Two consequences that explain most gateway problems.
The gateway must be on the same network. The device reaches the gateway directly, without routing, because routing is precisely what it is asking the gateway to do. A gateway address outside the local network is unreachable, and the host either reports the configuration as invalid or silently fails to send anything at all.
The gateway does not need to know the destination network either. It only needs to know a device that knows more. Your router forwards to your provider, who forwards onward, and every hop repeats the same decision.
On the wireWhat actually happens on the wire
Worth following once, because it explains why a gateway problem produces the connectivity symptoms it does.
A host at 192.168.1.50 with a mask of 255.255.255.0 wants to send data to 203.0.113.10.
It compares the addresses. 203.0.113.10 is not inside the 192.168.1.0/24 network, so the destination is external.
It looks up the routing table, finds no specific route, and selects the default route pointing at 192.168.1.1.
It needs the gateway's hardware address, so it sends an ARP request asking who has 192.168.1.1. The router answers with its MAC address.
It builds the frame with two different addresses. The destination IP address is 203.0.113.10, the final destination. The destination MAC address is the router's. That difference is the whole of network routing in one sentence: the IP address names which host the data is for, the MAC address names the next device to hand it to.
The router receives it, sees a MAC address that is its own and an IP address that is not, and therefore knows to forward the packet onward. It rewrites the MAC addresses for the next hop and repeats the process.
The IP addresses do not change along the way, apart from network address translation at the edge. The MAC addresses change at every hop between networks.
Gateway vs routerGateway vs router: what is the difference?
A router is a device, and a gateway is a role. A router forwards packets between networks at layer 3, for example between your LAN and your provider. The default gateway is whichever router a host has been told to use as its first hop, so every default gateway is a router and most routers are somebody's gateway.
The word has two other common uses, which is where gateway vs router becomes confusing.
- The box from the internet provider. Providers call their combined modem, router, switch and Wi-Fi access point a gateway, because it is the single point through which the home network reaches the internet.
- A protocol gateway. A VoIP gateway, an IoT gateway or an email security gateway translates between two different protocols or inspects traffic at a higher layer. A router moves IP packets and does not translate them.
In a device's network settings, the default gateway always means the first sense: the address of the local router.
How to find itFinding it, on any platform
ipconfig # Windows, look for Default Gateway
route print # Windows, the whole routing table
ip route # Linux, the default line is first
netstat -rn # macOS and older Linux
Get-NetRoute -DestinationPrefix 0.0.0.0/0 # Windows, preciselyRead the whole routing table rather than just the gateway line when the network is misbehaving. The default route appears as destination 0.0.0.0 with mask 0.0.0.0 on Windows, or as a line beginning default on Linux and macOS.
Finding the default gateway in settings
Every operating system also shows the default gateway in its network settings, next to the IP address and subnet mask. Apple's Mac User Guide puts it under System Settings, Network, Details, TCP/IP, where the field is labeled router. Phones show it in the details of the connected Wi-Fi network, labeled Router on iOS and Gateway on most Android builds.
The usual reason to look it up, apart from troubleshooting, is to reach the router itself. On a home or small office network, typing the default gateway address into a browser opens the router's admin page, which is where Wi-Fi, DHCP and port forwarding settings live.
That page is also the access point to the whole network, so its factory password should not survive the first login.
What to look for in the routing table
Two things to look for in that table.
More than one default route. Hosts with a VPN adapter frequently have two gateways, and which one wins depends on the metric. That is the mechanism behind data going out of the wrong network interface, and reading both metrics tells you which the host will actually use.
A specific route that should not be there. A leftover static route from a project years ago overrides the default for one destination and nothing else. It is invisible until somebody tries that destination.
The three pings, and what each combination of results means.
| Own address | The gateway | A remote host | Conclusion |
|---|---|---|---|
| Fails | Fails | Fails | The network stack, not the gateway |
| Works | Fails | Fails | No gateway, wrong gateway, or the router is down |
| Works | Works | Fails by name only | DNS, and the gateway is fine |
| Works | Works | Fails by address | The router is up and forwarding nothing |
| Works | Works | Works | The gateway is not your problem |
The second row is the one this page is about, and the third is the one people report as a gateway fault when it is not. Pinging by address rather than by name is what separates them, and it takes one command.
Failure modesThe four ways it goes wrong
Each produces a different symptom, and recognizing the symptom skips the diagnosis.
No default gateway at all. Devices on the local network are reachable and nothing external is. Usually DHCP failed and the host has a 169.254 address, or a static configuration was entered without the gateway field.
A gateway on the wrong network. Windows refuses this outright, Linux accepts it and then cannot reach it. The symptom is identical to having no gateway, and the cause is a typo in one octet.
The gateway address is right and the router is down. Local network traffic works, external connectivity fails, and pinging the gateway fails too. That last test separates this case from the next one.
The gateway answers and forwards nothing. Pinging the gateway succeeds and nothing beyond it works. The router has lost its own default route, or the link to the provider is down. This is the case where the problem is not on your network at all.
The test order follows from that list: ping your own address, ping the gateway, then ping a host on another network. The first failure tells you which of the four you have.
The third case is the one a design can remove. Where a subnet cannot afford to lose its router, two routers share the gateway address through HSRP or VRRP, and the hosts keep the same gateway whichever one is answering.
PitfallsWhere people go wrong
Assuming the default gateway is always .1. It is a networking convention, not a rule. Plenty of networks use the highest usable address instead, and plenty of devices default to something else entirely. Read the configuration rather than guessing.
Setting a gateway on a second interface. A host with two network interfaces should normally have exactly one default gateway. Two default gateways produce unpredictable routing, and the fix is a specific network route on the second interface rather than a second default.
Confusing the gateway with the DNS server. They are frequently the same address on a home network and they are different network functions. A working gateway with a broken resolver looks like no connectivity, and the two ping test separates them in seconds.
Forgetting that a VPN adds a gateway. Most VPN clients install a second default route with a better metric, which is how full tunnel mode works. When data goes somewhere unexpected while a tunnel is up, this is why.
Static addressing with no documentation. Devices given a static address and gateway by somebody who has left, on networks that have since been renumbered, work until they are rebooted. Every network has a few.
Expecting the gateway to fix a subnet mask error. A wrong mask makes the host believe remote addresses are on the local network, so it never consults the gateway at all. It ARPs for a device that cannot hear it and times out. The gateway is fine and is never asked.
ComparisonThe gateway, the router and the resolver, and how to tell which one failed
| Criterion | Default gateway | Router | DNS server |
|---|---|---|---|
| What it is | A route on the device | A physical device | A service |
| Answers "where do I send this" | Yes | No | No |
| Turns names into addresses | No | No | Yes |
| Must be on the local subnet | Yes | Yes, one interface | No |
| Often the same address | Yes | Yes | Sometimes |
| Failure looks like | No internet | No internet | No internet |
| Distinguished by | Pinging it | Pinging it | Pinging by address |
The last two rows are the useful part. All three failures present identically to a user, and pinging the gateway address then an internet address separates them in two commands.
FAQFrequently asked questions
What is a default gateway in simple terms?
The address a device sends traffic to when the destination is not on its own network. On most networks it is the router that provides internet access.
How do I find my default gateway?
ipconfig on Windows, ip route on Linux, netstat -rn on macOS. The Windows routing table shows it as destination 0.0.0.0 with mask 0.0.0.0.
Is the default gateway the same as the router?
Usually the same address, and they are different concepts. The gateway is a route configured on your device. The router is the physical thing at the other end of it.
Why must the gateway be on the same subnet?
Because the device reaches it directly, without routing. Routing is what it is asking the gateway to do, so it cannot route in order to reach it.
What is 0.0.0.0/0?
The default route written as a prefix. It matches every possible address, which makes it the least specific route, so it is only used when nothing better matches.
Can a device have two default gateways?
It can, and it usually should not. A VPN client commonly adds a second, and which one is used depends on the interface metric. For two physical connections, use a specific route rather than a second default.
Why can I reach local devices but not the internet?
Almost always the gateway: missing, wrong, or unreachable. Ping the gateway address. If that fails the problem is local, and if it succeeds the problem is beyond it.
Is the default gateway always .1?
No. It is a common convention and nothing more. Some networks use the last usable address, and some appliances default elsewhere.
Does a device need a gateway to work?
Only to reach anything off its own subnet. A device that talks only to others on the same network works perfectly without one.
What happens if the gateway is down?
Local traffic continues normally and everything else fails. The machine keeps sending to an address that no longer answers, so the failure is a timeout rather than an error.
How does the device find the gateway's MAC address?
With ARP. It broadcasts asking who holds the gateway IP address, and the router answers with its hardware address, which is then cached.
Why does traffic go out the wrong interface when the VPN is up?
Because the VPN installed a default route with a better metric. Read the whole routing table, compare the metrics, and set them deliberately rather than accepting the client default.
What does gateway not reachable mean?
It means the device cannot get a reply from its default gateway, so nothing beyond the local network will work. The usual causes of a gateway not reachable are a wrong IP address or subnet mask, a bad cable or Wi-Fi connection, a device in the wrong VLAN, or a router that is down. Ping the gateway address first.
Keep readingRelated concepts
Read next · Addressing What Is a Subnet? Whether a destination is local is decided by the mask, and a wrong mask means the gateway is never asked. Open this next15 min- Addressing · 9 min What Is DHCP? The gateway address is one of the settings DHCP hands out, alongside the mask and the resolvers.
- Diagnostics · 11 min Ping and Traceroute Pinging your address, the gateway, then something beyond it identifies the failure in three commands.
- Fundamentals · 10 min Modem and Router, and What the Box From Your Internet Provider Does What the router looks like from a device.
- Fundamentals · 13 min ARP Explained, and the One Thing Everyone Gets Wrong About It The address a host resolves whenever the destination is somewhere else.
- Routing · 12 min Static vs Dynamic Routing, and the Route That Never Fails The same route, on the machines rather than on the router.
- Fundamentals · 9 min Link Local Addresses, and Why One of Them Is Bad News Link local addresses, which are the reason an IPv6 gateway looks wrong and is not.
- Switching · 9 min Inter VLAN Routing, and Why Two VLANs Cannot Talk Without It What answers at that address when the two networks are VLANs on one switch.
- Routing · 11 min HSRP vs VRRP, and What Happens When the Default Gateway Dies Keeping this address answering when the router behind it fails, with two routers sharing it.