Overview
Most devices do not hold a full internet routing table. Instead they rely on a single crucial route: the default gateway — the router they hand any off-network traffic to. This lesson explains the default gateway and its central role in connectivity.
Learning objectives
- Define the default gateway.
- Explain when a host uses it.
- Connect the gateway to the local/remote delivery decision.
Core concept
The default gateway is the router a host sends packets to when the destination is not on its own local network. A typical host's routing logic is simple: if the destination is local (same subnet, per the subnet mask), deliver directly; otherwise, send it to the default gateway, which takes responsibility for forwarding it onward.
The gateway is effectively the host's route of last resort — its 0.0.0.0/0 (everything else) next hop.
How it works
Using its IP and subnet mask, a host determines whether a destination is local or remote (the decision introduced in the addressing lessons). For a local destination it uses ARP to find the target's MAC and delivers directly. For a remote destination it uses ARP to find the gateway's MAC and sends the packet there; the gateway then routes it toward its destination. Without a correct default gateway, a host can reach local peers but nothing beyond the LAN.
Practical example
A laptop 192.168.1.50/24 with gateway 192.168.1.1 wants to reach:
192.168.1.80(same subnet) → delivered directly on the LAN.93.184.216.34(remote) → sent to the gateway192.168.1.1, which forwards it toward the internet.
If the gateway were misconfigured, the laptop could still print to a local printer but could not load any website — a classic symptom.
Cybersecurity relevance
The default gateway is a high-value point: all off-network traffic passes through it. That makes it a target — ARP poisoning that impersonates the gateway lets an attacker intercept a host's outbound traffic (a man-in-the-middle position). A rogue DHCP server handing out a malicious gateway achieves the same. Monitoring for unexpected gateway changes is a defensive measure, and recognizing "gateway unreachable" symptoms aids diagnosis.
Common mistakes
- Confusing local and remote delivery — only remote-destined traffic goes to the gateway.
- Forgetting the gateway must be on the same subnet as the host to be reachable directly.
- Overlooking the gateway as an attack point for interception.
Key takeaways
- The default gateway is the router a host sends all non-local (remote) traffic to.
- A host delivers locally when the destination is on its subnet, and via the gateway otherwise.
- The gateway carries all outbound traffic, making it critical for connectivity and a prime target for interception (ARP poisoning, rogue DHCP).
Check your understanding
- When does a host send a packet to its default gateway rather than delivering it directly?
- Why is the default gateway an attractive target for a man-in-the-middle attacker?