persistant default route on debian 9

Question

I have three interfaces on a Debian 9 box. I need to set the default route permanently for the entire system. I have attempted to add it in different ways to the /etc/network/interfaces file, but cant seem to find the right option. I have put the down route on the interfaces section as well as at the bottom of the file, but none seem to work for me. What is the correct syntax? all routes should go out the ens256 and all local routes should go out the other interfaces.

    # The primary network interface
allow-hotplug ens192
iface ens192 inet static
  address 10.21.30.10
  netmask 255.255.255.0
  gateway 10.21.30.254
down route del default gw 10.21.30.254

allow-hotplug ens224
iface ens224 inet static
  address 10.21.10.10
  netmask 255.255.255.0
  gateway 10.21.10.254
down route del default gw 10.21.10.254

allow-hotplug ens256
iface ens256 inet static
  address 1.2.3.157
  netmask 255.255.255.248
  gateway 1.2.3.153
  dns-nameservers 4.2.2.2 8.8.8.8
up route add default gw 1.2.3.153

---

If I put the post config at the end of the file. "post-up /bin/ip route add default via 1.2.3.153 dev ens256" This works and I am able to ping go out to the internet, but cant seem to run apt-get. When I run this I get the following error.

Ign:1 http://security.debian.org/debian-security stretch/updates InRelease
Err:2 http://security.debian.org/debian-security stretch/updates Release
  Connection failed [IP: 199.232.32.204 80]
Ign:3 http://ftp.us.debian.org/debian stretch InRelease
Ign:4 http://ftp.us.debian.org/debian stretch-updates InRelease
Err:5 http://ftp.us.debian.org/debian stretch Release
  Connection failed [IP: 208.80.154.15 80]
Err:6 http://ftp.us.debian.org/debian stretch-updates Release
  Connection failed [IP: 64.50.233.100 80]
Reading package lists... Done
E: The repository 'http://security.debian.org/debian-security stretch/updates Release' does no longer have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: The repository 'http://ftp.us.debian.org/debian stretch Release' does no longer have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: The repository 'http://ftp.us.debian.org/debian stretch-updates Release' does no longer have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Answer 1

I believe you must have only one gateway line.

Answer 2

I had something similar here

allow-hotplug ens192
iface ens192 inet static
  address 10.21.30.10/24
  gateway 10.21.30.254
  down /bin/ip route del default via 10.21.30.254

allow-hotplug ens224
iface ens224 inet static
  address 10.21.10.10/24
  gateway 10.21.10.254
  down /bin/ip route del default via 10.21.10.254

allow-hotplug ens256
iface ens256 inet static
  address 1.2.3.157/29
  up /bin/ip route add default via 1.2.3.153 dev ens256

After the up or post-up directives, you can actually add any command you like. In this case, I used /bin/ip route.

You're question is mostly about the syntax of the static method. Here's what man interfaces has to say about what's available:

IFACE OPTIONS
   The following "command" options are available for every family and
   method.  Each of these options can be given multiple times in a single
   stanza, in which case the commands are executed in the order in which
   they appear in the stanza.  (You can ensure a command never fails by
   suffixing them with "|| true".)

   pre-up command
      Run  command  before  bringing the interface up.  If this command
      fails then ifup aborts, refraining from marking the interface as
      config‐ured, prints an error message, and exits with status 0.  This
      behavior may change in the future.

   up command

   post-up command
      Run command after bringing the interface up.  If this command fails
      then ifup aborts, refraining from marking the interface as  configured
      (even though it has really been configured), prints an error message,
      and exits with status 0.  This behavior may change in the future.

   down command

   pre-down command
      Run  command before taking the interface down.  If this command fails
      then ifdown aborts, marks the interface as deconfigured (even though
      it has not really been deconfigured), and exits with status 0.  This
      behavior may change in the future.

   post-down command
      Run command after taking the interface down.  If this command fails
      then ifdown aborts, marks the interface  as  deconfigured,  and  exits
      with status 0.  This behavior may change in the future.

   description name
      Alias interface by name

The static Method
   This method may be used to define Ethernet interfaces with statically
   allocated IPv4 addresses.

   Options
      address address
         Address (dotted quad/netmask) required

      netmask mask
         Netmask (dotted quad or number of bits) deprecated

      broadcast broadcast_address
         Broadcast address (dotted quad, + or -) deprecated. 
         Default value: "+"

      metric metric
         Routing metric for default gateway (integer)

      gateway address
         Default gateway (dotted quad)

      pointopoint address
         Address of other end point (dotted quad). Note the spelling
         of "point-to".

      hwaddress address
         Link local address or "random".

      mtu size
         MTU size

      scope  Address validity scope. Possible values: global, link, host

You may notice that route is not an option. You'll need to use /bin/ip route or gateway for that. Also, dns-nameservers is also not an option. You'll need to use resolv.conf for that (or maybe network manager if that's overwriting it).