Overview
When a host needs to reach a network other than its own, it sends traffic to a gateway — typically a router that forwards packets toward other networks. The default gateway is one of the most important settings on any host. This lesson explains what gateways do and why they matter.
Learning objectives
- Define a gateway and the default gateway.
- Explain when a host uses its gateway.
- Understand the gateway's role in reaching the internet.
Core concept
A gateway is a device (usually a router) that connects a local network to other networks, forwarding traffic between them. The default gateway is the address a host sends packets to when the destination is not on its own local network — the "way out" of the LAN.
Every host that needs to communicate beyond its local network is configured (manually or via DHCP) with a default gateway address.
How it works
When a host prepares to send a packet, it checks whether the destination IP is on its own local network (using its subnet mask):
- Same network → deliver directly on the LAN (resolve the destination's MAC via ARP and send).
- Different network → send the packet to the default gateway, which then routes it onward toward the destination.
So the gateway is the host's first hop for any traffic leaving the local network — including everything destined for the internet.
Practical example
Your laptop (192.168.1.10) wants to load a website hosted at 203.0.113.5. Recognizing that 203.0.113.5 is not on its local 192.168.1.x network, the laptop sends the packet to its default gateway (the router at 192.168.1.1). The router forwards it toward the internet. When you reach another device on your own LAN, the laptop delivers directly and the gateway is not involved.
Cybersecurity relevance
The default gateway is a high-value point: because all outbound (and much inbound) traffic passes through it, the gateway/router is where firewalls, NAT, and monitoring are enforced. It is also a target — ARP spoofing attacks often impersonate the gateway to intercept a victim's traffic, since fooling a host about its gateway's MAC redirects everything leaving the LAN.
Common mistakes
- Assuming all traffic goes through the gateway — local (same-network) traffic is delivered directly and bypasses it.
- Misconfiguring the default gateway, which breaks all communication beyond the local network.
Key takeaways
- A gateway (usually a router) connects a local network to others; the default gateway is the exit for non-local traffic.
- A host sends directly on the LAN for same-network destinations and to the gateway for everything else.
- The gateway is where firewalls/NAT/monitoring live and is a common target of interception attacks.
Check your understanding
- How does a host decide whether to deliver a packet directly or send it to the default gateway?
- Why is the default gateway an attractive target for a man-in-the-middle attacker?