The route command: print, add, delete, persistent routes
Every packet leaving your computer is matched against the routing table to pick an interface and a next hop. route shows and edits that table. Three implementations share the name and disagree on syntax; this page covers each and the modern replacements.
How a routing table is read
The kernel picks the most specific matching route (longest prefix). A /32 host route beats a /24, which beats the default route (0.0.0.0/0). Among equal prefixes the lowest metric wins. A route is either on-link (the destination is directly reachable, send it out the interface and ARP for it) or via a gateway (send it to the router's MAC, addressed to the final destination). The default route exists so that anything not matched elsewhere goes to your router.
Windows: route print, add, delete
route print # everything: interface list, IPv4 and IPv6 tables, persistent routes
route print -4 # IPv4 only
route print -6
route print 192.168.* # routes matching a pattern
route print 0.0.0.0 # just the default route(s)===========================================================================
Interface List
12...8c 16 45 3a 9b 2d ......Intel(R) Ethernet Connection (7) I219-V
7...84 5c f3 1a 2b 3c ......Intel(R) Wi-Fi 6E AX211 160MHz
1...........................Software Loopback Interface 1
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.42 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
192.168.1.0 255.255.255.0 On-link 192.168.1.42 281
192.168.1.42 255.255.255.255 On-link 192.168.1.42 281
192.168.1.255 255.255.255.255 On-link 192.168.1.42 281
224.0.0.0 240.0.0.0 On-link 192.168.1.42 281
255.255.255.255 255.255.255.255 On-link 192.168.1.42 281
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
10.0.0.0 255.0.0.0 192.168.1.254 1
===========================================================================- Interface List
- Index numbers (12, 7, 1) map to adapters. These are the zone IDs in link-local IPv6 addresses (
fe80::1%12) and theifargument toroute add. - 0.0.0.0 / 0.0.0.0 → 192.168.1.1
- The default route via the router. Two such lines with different metrics mean two active connections; the lower metric wins. No such line means no internet. Fix →
- On-link
- Directly reachable, no gateway. Your own subnet, your own address, broadcast and multicast are all on-link.
- Metric
- Interface metric plus route metric. Windows assigns interface metrics automatically from link speed (25 for gigabit, higher for slower) unless you override them.
- Persistent Routes
- Routes added with
-p, stored in the registry and re-applied at boot.
:: add a route to 10.0.0.0/8 via 192.168.1.254 (admin)
route add 10.0.0.0 mask 255.0.0.0 192.168.1.254
:: with a metric and a specific interface index
route add 10.0.0.0 mask 255.0.0.0 192.168.1.254 metric 5 if 12
:: persistent across reboots
route -p add 10.0.0.0 mask 255.0.0.0 192.168.1.254
:: change the gateway of an existing route
route change 10.0.0.0 mask 255.0.0.0 192.168.1.253
:: delete
route delete 10.0.0.0
route delete 10.0.0.0 mask 255.0.0.0 192.168.1.254 :: when several match
:: add a default route
route add 0.0.0.0 mask 0.0.0.0 192.168.1.1 metric 10
:: delete every default route (careful)
route delete 0.0.0.0
:: flush all gateway routes (very careful; DHCP renew restores the default)
route -f
:: IPv6
route add 2001:db8::/32 fe80::1 if 12
netsh interface ipv6 add route 2001:db8::/32 "Ethernet" fe80::1PowerShell equivalents, which are persistent by default and object-based:
Get-NetRoute -AddressFamily IPv4 | Sort-Object RouteMetric | Format-Table DestinationPrefix, NextHop, InterfaceAlias, RouteMetric, InterfaceMetric
Get-NetRoute -DestinationPrefix 0.0.0.0/0
Find-NetRoute -RemoteIPAddress 1.1.1.1 # which route will be used
New-NetRoute -DestinationPrefix 10.0.0.0/8 -InterfaceAlias Ethernet -NextHop 192.168.1.254 -RouteMetric 5
New-NetRoute -DestinationPrefix 10.0.0.0/8 -InterfaceAlias Ethernet -NextHop 192.168.1.254 -PolicyStore ActiveStore # not persistent
Remove-NetRoute -DestinationPrefix 10.0.0.0/8 -Confirm:$false
Set-NetIPInterface -InterfaceAlias Wi-Fi -InterfaceMetric 50 # prefer/deprefer an interface
Get-NetIPInterface | Sort-Object InterfaceMetric | Format-Table InterfaceAlias, AddressFamily, InterfaceMetric, ConnectionStateLinux: net-tools route (deprecated) and ip route
route -n # numeric; -n avoids slow reverse DNS
route -n -A inet6 # IPv6
route -e # netstat-style output
route -C # routing cache (empty on modern kernels)Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 100 0 0 enp3s0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 wg0
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
192.168.1.0 0.0.0.0 255.255.255.0 U 100 0 0 enp3s0| Flag | Meaning |
|---|---|
| U | Route is up |
| G | Via a gateway (the Gateway column is a router, not 0.0.0.0) |
| H | Host route (single address, /32) |
| D | Created dynamically by an ICMP redirect |
| M | Modified by an ICMP redirect |
| ! | Reject route: traffic is refused |
| A, C, L | Address, cache and local routes (rare in modern output) |
sudo route add default gw 192.168.1.1
sudo route add default gw 192.168.1.1 dev enp3s0
sudo route add -net 10.0.0.0/8 gw 192.168.1.254
sudo route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.1.254
sudo route add -host 192.168.1.99 dev enp3s0
sudo route add -net 192.168.50.0/24 reject # blackhole
sudo route del default gw 192.168.1.1
sudo route del -net 10.0.0.0/8The same with ip route, which is what every current distribution expects:
ip route
ip -6 route
ip route get 1.1.1.1
sudo ip route add default via 192.168.1.1
sudo ip route add 10.0.0.0/8 via 192.168.1.254 dev enp3s0 metric 5
sudo ip route add 192.168.1.99/32 dev enp3s0
sudo ip route add blackhole 192.168.50.0/24
sudo ip route replace default via 192.168.1.254
sudo ip route del 10.0.0.0/8
ip route show table all # policy routing tables tooNeither is persistent. Save routes in NetworkManager (nmcli con mod "X" +ipv4.routes "10.0.0.0/8 192.168.1.254"), Netplan (routes: list), systemd-networkd ([Route] sections) or ifupdown (up ip route add … lines). Linux configuration →
macOS and BSD: route
BSD route uses verbs (get, add, delete, change, flush, monitor) and has no gw keyword; the gateway is simply the last argument.
netstat -rn # the routing table (route itself does not list it on macOS)
netstat -rn -f inet # IPv4 only
route -n get default # default gateway, interface, MTU
route -n get 1.1.1.1 # which route a destination uses
sudo route add -net 10.0.0.0/8 192.168.1.254
sudo route add -net 10.0.0.0 -netmask 255.0.0.0 192.168.1.254
sudo route add -host 192.168.1.99 -interface en0
sudo route add default 192.168.1.1
sudo route change default 192.168.1.254
sudo route delete -net 10.0.0.0/8
sudo route delete default
sudo route -n flush # remove all gateway routes (DHCP will restore the default)
sudo route monitor # watch routing socket messages live
sudo route add -inet6 default fe80::1%en0$ netstat -rn -f inet
Routing tables
Internet:
Destination Gateway Flags Netif Expire
default 192.168.1.1 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.1 link#12 UCS en0 !
192.168.1.1/32 link#12 UCS en0 !
192.168.1.1 d4:6e:0e:11:22:33 UHLWIir en0 1188
192.168.1.23/32 link#12 UCS en0 !
224.0.0/4 link#12 UmCS en0 !
255.255.255.255/32 link#12 UCS en0 !BSD flags: U up, G gateway, H host, S static, C cloning (generates host routes on demand), L has link-layer address, W was cloned, I interface-scoped, g/i global/IPv6-related on macOS, m multicast, ! reject. The UHLW lines with MAC addresses are the ARP cache showing through, with an expiry in seconds. On FreeBSD, route -n show default also works, and persistence is defaultrouter= and static_routes= in /etc/rc.conf. macOS 13 and later can persist extra routes per service with networksetup -setadditionalroutes "Wi-Fi" 10.0.0.0 255.0.0.0 192.168.1.254.
Common tasks
Send one network through a VPN and everything else normally
route add 10.0.0.0 mask 255.0.0.0 10.8.0.1 if 15 :: Windows: via the VPN's gateway and interface
sudo ip route add 10.0.0.0/8 dev wg0 # Linux: WireGuard is point-to-point, no gateway needed
sudo route add -net 10.0.0.0/8 -interface utun3 # macOSReach a second router on the LAN that leads to another subnet
route -p add 192.168.2.0 mask 255.255.255.0 192.168.1.254
sudo ip route add 192.168.2.0/24 via 192.168.1.254
sudo route add -net 192.168.2.0/24 192.168.1.254Better: add that route on your main router instead, so every device gets it without configuration, or hand it out via DHCP option 121.
Force a host to be unreachable
route add 203.0.113.5 mask 255.255.255.255 0.0.0.0 if 1 :: Windows: via loopback (crude)
sudo ip route add blackhole 203.0.113.5/32 # Linux
sudo route add -host 203.0.113.5 127.0.0.1 -blackhole # macOS/BSDWhy does the wrong interface carry my traffic?
route print -4 | findstr 0.0.0.0 :: two defaults; lower metric wins
ip route get 1.1.1.1 # Linux: shows the chosen route and source
route -n get 1.1.1.1 # macOSAdjust interface metrics (Windows, Linux) or service order (macOS). Details →
Errors
| Message | Platform | Meaning |
|---|---|---|
| The route addition failed: The parameter is incorrect. | Windows | The gateway is not on any connected subnet, or the mask does not fit the destination (host bits set). Check both. |
| The requested operation requires elevation. | Windows | Run as administrator. |
| The route addition failed: Either the interface index is wrong or the gateway does not lie on the same network as the interface. | Windows | The if index or the gateway is wrong for that interface. |
| SIOCADDRT: Network is unreachable | Linux route | The gateway is not directly reachable; add the interface address or subnet route first. |
| SIOCADDRT: File exists | Linux route | The route already exists; delete or change it. |
| RTNETLINK answers: Network is unreachable / File exists / No such process | Linux ip | Same three causes: gateway unreachable, duplicate, or deleting something that does not exist as specified. |
| route: writing to routing socket: Network is unreachable | macOS/BSD | Gateway not on a connected subnet. |
| route: writing to routing socket: File exists | macOS/BSD | Duplicate; use change. |
| route: writing to routing socket: not in table | macOS/BSD | Deleting a route that is not there, or route get default with no default route. |