An IPv4 default route is the prefix 0.0.0.0/0: it matches every IPv4 destination, with the least possible specificity. In a selected routing table, a longer matching prefix normally takes precedence. The default is not a procedure that retries whenever a more specific route fails. Routing policy selects relevant tables, and the chosen route describes a forwarding decision rather than promising that the entire round trip will succeed.

When it breaks

A machine without a default can still reach destinations covered by connected or explicit routes. Conversely, adding a default does not prove internet access. The next hop needs to be reachable, forwarding and filtering must permit the traffic, and replies need a return path. A displayed gateway is only one part of that contract; application communication supplies the evidence that the configured path works.

A more specific rejection route wins over a working default. Linux route types such as unreachable intentionally stop forwarding for matching destinations. A failed neighbor lookup through a selected gateway also does not mean the kernel will automatically search for a healthier, less specific path. Static route preference and metrics are not a service-health monitoring or failover system.

Return-path errors are particularly misleading. The client can select the expected gateway and send traffic toward a listening server, yet fail because the server cannot route replies to the client. Repeatedly changing the client’s default may damage working destinations without repairing that missing reverse path. Inspect both directions and the actual source address before attributing every connection timeout to the sender’s gateway.

Check it quickly

Save this as check-default-route.py and run python3 check-default-route.py with Docker. Python 3.11.16 and iproute2 6.1.0 build a client–router–target topology inside one disposable Linux container. NET_ADMIN and SYS_ADMIN support its nested namespaces and temporary proc mount. All interfaces are newly created veth devices, and no port or route is published on the host:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
    result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
    if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
    return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
    if process.poll() is None:
        process.terminate()
        try:process.wait(timeout=2)
        except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
    assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
    value=process.stdout.readline();assert value,'child exited without a response'
    return value
def spawn(stack,command):
    process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
    stack.callback(stop,process);return process
@contextmanager
def lab(names):
    with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
        root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
        stack.callback(run,'umount',str(proc))
        for name in names:
            run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
            ip(name,'link','set','lo','up')
        def setting(name,key,value):
            assert name in names
            path=proc/'sys'/key.replace('.','/')
            return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
        yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
    run('ip','link','add',left_if,'type','veth','peer','name',right_if)
    for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
        run('ip','link','set',interface,'netns',name)
        for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
        ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
    data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
    for entry in data['nftables']:
        rule=entry.get('rule',{})
        if 'comment' in rule:
            for expression in rule['expr']:
                if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
    return found

def server(stack,name,address,port=18080,label='server'):
    code=r'''
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import json,socket,sys
address,port,label=sys.argv[1],int(sys.argv[2]),sys.argv[3]
class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        body=json.dumps({'server':label,'peer':self.client_address,'path':self.path}).encode()
        self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
    def log_message(self,*args):pass
class Server(ThreadingHTTPServer):
    address_family=socket.AF_INET6 if ':' in address else socket.AF_INET
    def server_bind(self):
        if self.address_family==socket.AF_INET6:self.socket.setsockopt(socket.IPPROTO_IPV6,socket.IPV6_V6ONLY,1)
        super().server_bind()
service=Server((address,port),Handler);print('ready',flush=True);service.serve_forever()
'''
    process=spawn(stack,['ip','netns','exec',name,'python3','-u','-c',code,address,str(port),label])
    assert line(process).strip()=='ready';return process
def request(name,address,port=18080):
    code=r'''
import http.client,json,sys
client=http.client.HTTPConnection(sys.argv[1],int(sys.argv[2]),timeout=.7)
try:
    client.request('GET','/lab-visible-message');response=client.getresponse();body=json.loads(response.read())
    assert response.status==200;print(json.dumps({'ok':True,'status':response.status,'body':body}))
except OSError as error:print(json.dumps({'ok':False,'type':type(error).__name__,'errno':error.errno}))
finally:client.close()
'''
    return json.loads(ns(name,'python3','-c',code,address,str(port)).stdout)

def routed(setting):
    wire('client','c0','router','r0',['10.201.1.2/30'],['10.201.1.1/30'])
    wire('router','r1','target','t0',['10.201.2.1/30'],['10.201.2.2/30'])
    setting('router','net.ipv4.ip_forward',1)
    ip('client','route','add','default','via','10.201.1.1')
    ip('target','route','add','default','via','10.201.2.1')
with lab(['client','router','target']) as (root,stack,setting):
    routed(setting);ip('client','route','delete','default')
    ip('target','addr','add','198.51.100.9/32','dev','lo');ip('router','route','add','198.51.100.9/32','via','10.201.2.2')
    daemon=server(stack,'target','198.51.100.9')
    connected=ns('client','ping','-n','-c','1','-W','1','10.201.1.1');assert connected.returncode==0
    missing=request('client','198.51.100.9');assert not missing['ok'] and missing['errno']==101
    ip('client','route','add','default','via','10.201.1.1')
    chosen=json.loads(ip('client','-j','route','get','198.51.100.9').stdout)[0];assert chosen['gateway']=='10.201.1.1'
    healthy=request('client','198.51.100.9');assert healthy['ok']
    ip('client','route','add','unreachable','198.51.100.9/32')
    specific=request('client','198.51.100.9');assert not specific['ok'] and specific['errno']==113
    ip('client','route','delete','unreachable','198.51.100.9/32')
    recovered=request('client','198.51.100.9');assert recovered['ok']
    ip('target','route','delete','default')
    bad_return=request('client','198.51.100.9');assert not bad_return['ok'] and bad_return['type']=='TimeoutError'
    assert json.loads(ip('client','-j','route','get','198.51.100.9').stdout)[0]['gateway']=='10.201.1.1'
    ip('target','route','add','default','via','10.201.2.1')
    final=request('client','198.51.100.9');assert final['ok']
    print(json.dumps({'connected_ping_without_default':0,'no_default':missing,'chosen_route':chosen,'with_default':healthy,
        'specific_unreachable_route':specific,'specific_removed':recovered,'missing_return_route':bad_return,'return_route_restored':final}))
"""
name='xbcatm-netpath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
    with TemporaryDirectory(prefix=name+'-') as directory:
        root=Path(directory);(root/'Dockerfile').write_text(recipe)
        build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
        result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
            '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
        assert result.returncode==0,result.stderr
        print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
    docker('rm','-f',name);docker('image','rm',name)

The client uses 10.201.1.2, with router neighbor 10.201.1.1. The target sits behind the router on another link and owns service address 198.51.100.9 on loopback. The router has a specific route to that service, and the target initially has a return default. The documentation address is used only within this isolated topology; no public server is contacted.

With the client’s default removed, pinging its directly connected router succeeds. An HTTP connection to the remote service fails with Linux ENETUNREACH, errno 101. Adding a default through 10.201.1.1 changes the route lookup to that gateway, and an actual HTTP request returns status 200. This demonstrates both the narrower connectivity that already existed and the additional path enabled by the default.

An unreachable /32 route is then installed for 198.51.100.9. The same connection now fails with EHOSTUNREACH, errno 113, despite the default still being present. Removing that specific route restores HTTP success. The kernel honored the more specific rejection; it did not treat the error as an invitation to fall back to the default gateway.

Next, the script removes only the target’s default route. The client’s lookup still names 10.201.1.1, but a new HTTP attempt reaches its timeout. Restoring the target’s default restores communication. This controlled comparison isolates the return-path dependency while leaving the client’s choice unchanged, providing stronger evidence than a one-sided route listing or an unexplained failed ping.

Inspect the exact flow before editing defaults

Record source address, destination, relevant policy rules, chosen interface, and gateway. A machine with several interfaces or routing tables can make different decisions for different sources, marks, or routing domains. Run diagnostic lookups with the application’s relevant inputs. The fixture uses ordinary destination-based routing and does not claim to reproduce every policy-routing or multipath configuration.

Check the next hop’s link reachability, the router’s forwarding decision, and the target’s route back to the actual source. NAT or a proxy may change which source the target sees. Error classes can guide this work: immediate local network-unreachable errors differ from an explicitly unreachable host route and from a deadline expiring while a reply cannot return. Keep those distinctions in incident evidence.

Defaults are useful because they summarize destinations whose individual routes the host need not know. Configure them deliberately, verify exceptions, and test representative round trips after changes. If automatic failover is required, use a mechanism that observes the relevant path and updates routing appropriately. A second configured gateway or a preferred metric alone does not establish that behavior.

Sources