Explain default gateways and routed traffic

What you should be able to do

Trace a packet from a low-voltage endpoint to another subnet and trace the reply. Distinguish the final IP destination from the local forwarding next hop. This is a fictional ordinary IPv4 routing exercise with no NAT, tunneling or policy-based routing.

Supplied Topology

Camera:192.168.10.20/24; default gateway192.168.10.1. Router interface A:192.168.10.1/24. Router interface B:192.168.20.1/24. Recorder:192.168.20.30/24; default gateway192.168.20.1. The router has both subnets connected and is configured to route permitted traffic. The endpoints have the indicated default routes and no overriding specific routes. Access switches are omitted from the logical drawing.

What Default Means

The default route is the least-specific destination route, represented as0.0.0.0/0 for IPv4. In ordinary destination-based forwarding, a more-specific matching route is preferred. A default gateway is the next-hop router used by that default route; it is not the final destination of every packet.

For example, a local192.168.10.0/24 route is more specific than0.0.0.0/0. Traffic to another reachable host on that local LAN ordinarily uses local delivery. Traffic to the recorder's192.168.20.30 address follows the camera's default route under the stated exercise assumptions.

Where beginners go wrong

Sources

Forward Journey

The camera compares the destination with its configured routes.192.168.20.30 is outside its local192.168.10.0/24 network. The selected next hop is192.168.10.1.

For local Ethernet transmission, the camera obtains the gateway interface's MAC address through the applicable neighbor/address-resolution process. The outgoing Ethernet destination is that gateway interface. The IP destination is still192.168.20.30. The camera is not expected to resolve the remote recorder's MAC directly across the routed boundary in this ordinary setup.

The router receives the frame addressed to its interface, processes the IP packet and selects the route toward192.168.20.0/24. Because that network is directly connected here, it can deliver toward the recorder using the recorder's MAC on that Ethernet segment. The new frame uses the router's outgoing Ethernet source address.

The forwarding IP source and destination remain the camera and recorder in this no-NAT example. This does not mean every IP-header field is unchanged; routing also processes fields such as time to live. The poster focuses on endpoint addresses and next-hop roles.

Return Journey

For a reply, the recorder becomes the IP source and the camera becomes the IP destination.192.168.10.20 lies outside the recorder's192.168.20.0/24 network. Under the supplied default route, the recorder sends locally to192.168.20.1. The router then forwards toward its directly connected192.168.10.0/24 network.

A working forward route does not establish the return path. Nor does a route override access controls. The approved application protocol must be permitted where filtering applies, and the destination service must actually function.

In larger networks, the return route does not have to use identical physical hops, but it must be valid and compatible with any relevant stateful policy. This lesson's single-router drawing uses the same router for clarity.

Wrong-Gateway Exercise

A technician copies192.168.10.1 into the recorder's gateway field. With the supplied /24, that is not on the recorder's local subnet. In this ordinary directly connected-host design it is the wrong next hop. The approved value is192.168.20.1.

The technician should compare the saved settings against the owner-provided plan and have the authorized correction applied. Do not widen the recorder's mask, add arbitrary routes or disable filtering merely to make the copied value appear to work.

Dns And Internet Are Separate

Both subnets in this exercise are internal. No internet connection is required. The default gateway may lead toward many internal destinations rather than a public network.

DNS is a name-resolution function. A gateway address should not be copied into the DNS field unless the approved design explicitly provides that service there. One appliance may perform both functions, but their roles and configuration evidence remain distinct.

Read Route Evidence Carefully

For a real authorized inspection, record source interface, destination prefix, selected next hop and relevant route information. Multiple interfaces, VPNs, specific routes or policy can alter the path. A remembered default-gateway setting is not enough to describe every destination.

A successful ping to the gateway only tests the observed exchange with that interface. It does not prove the gateway forwards the required traffic, that the remote endpoint replies or that the recorder accepts the camera stream. Verify the intended service separately using the approved procedure.

Worked through

Source endpoint/interface and prefix: Destination endpoint and prefix: Local or remote under the supplied plan: Matching route and next hop: Gateway interface reachable on the local link: Forward-path evidence: Destination return route: Applicable policy and application test: Observed result, limitation and owner:

Knowledge Check