20

I was looking at bringing up an interface like this in /etc/network/interfaces (this is on debian), with the gateway outside the subnet:

iface eth0 inet static
address 10.100.10.99
netmask 255.255.255.0
gateway 10.100.0.1

but "ifup --verbose eth0" only gives me this error message:

ifconfig eth0 10.100.10.99 netmask 255.255.255.0
 route add default gw 10.100.0.1  eth0
SIOCADDRT: No such process
Failed to bring up eth0

Of course, changing the netmask to 255.255.0.0 works just fine.

Is that even possible, or is there something else that's the problem? Is there a way to get more information out of ifup? I see one post on the internet that suggests it should work.

6 Answers 6

17

Another way of approaching this question is: if you can't reach your default-gateway router on a local network, how do you send packets through it? You'd have to send them through another router.

For some background, remember that an IP packet typically contains the source and destination addresses: where it comes from, and where it wants to go. It's usually up to the routers to decide how it gets there.

So when you send your IP packet through your off-network default gateway router, one of two things would need to happen.

  1. The local-network router knows how to reach the default-gateway router, and it agrees with your idea that your packet should be sent through the default-gateway router to get to its destination. In that case, why not just use the local-network router as your default gateway?

  2. The local-network router thinks (by default) that your packet should be sent through some other router to get to its destination. In this case you have to have some way to tell it otherwise. This capability exists, and is called "source routing"... but it is considered a security risk, and most routers are configured to ignore it.

Finally, in my experience, the Linux iproute (ip) tool will not let you add a route if the gateway cannot be reached directly via a local network interface.

A couple of source-routing references:

5

The default gateway has to be on the same subnet as the IP address of the device. It's typically the router's IP address of the network that you're connecting to. From the wikipedia page on Default Route:

In computer networking, a gateway is a node (a router) on a TCP/IP network that serves as an access point to another network. A default gateway is the node on the computer network that the network software uses when an IP address does not match any other routes in the routing table. It is actually the IP address of the router to which your PC network is connected.

In home computing configurations, an ISP often provides a physical device which both connects local hardware to the Internet and serves as a gateway. Such devices include DSL routers and cable routers.

In organizational systems a gateway is a node that routes the traffic from a workstation to another network segment. The default gateway commonly connects the internal networks and the outside network (Internet). In such a situation, the gateway node could also act as a proxy server and a firewall. The gateway is also associated with both a router, which uses headers and forwarding tables to determine where packets are sent, and a switch, which provides the actual path for the packet in and out of the gateway.

In other words, a default gateway provides an entry point and an exit point in a network.

5
  • But if there is a static route to an address, couldn't that be the default gateway even if it isn't on the subnet? (We're getting into technicalities here and away from good practice).
    – kurtm
    Oct 31, 2013 at 19:25
  • The static route can be a route, just not the default gateway (as I understand it).
    – slm
    Oct 31, 2013 at 19:34
  • 4
    The default route MUST be on the same subnet. The Default route is how you get all your traffic off your subnet and onto another. So from if your trying to get traffic from 10.100.10.99 to 10.100.0.1 you need a "gateway" to get from the 10.100.10.0/24 to 10.100.0.0/24 networks. 10.100.0.1 can not be your default gateway because you can't reach it by default. It can however be "a" gateway. And it can even be "the" gateway you send all of your traffic to (once you tell it how to get to the other network).
    – coteyr
    Oct 31, 2013 at 21:24
  • 2
    @coteyr: and yet I have this working. If there is a static route to the other subnet, and the default gateway is on that subnet, I am both able to add the default route and ping/make connections with no issues. It may be less efficient, but it works.
    – siride
    Aug 29, 2017 at 20:41
  • I would say: a route is how you get all your traffic off your subnet and onto another. When specifying a route, you can either specify an IP segment (or a supernet - a combination of segments) and a gateway to access that segment/supernet with, or you can specify "for everything else not mentioned in the routing table, use this gateway". The latter is the default route, and the gateway used in it is called the default gateway. When you have just one NIC, you almost always need only the default route; but with multiple NICs you may need other routes too.
    – telcoM
    Feb 20, 2018 at 7:14
3

The OP asks if there is any way to set a gateway from a different subnet. I will not delve into best practice discussions, however I've seen this practice quite a few times already and this page still shows up as first result from my searches, without this information in the clear.

the concept

You can set a host from a different subnet as the default gateway by routing to it first. Remember that while there are "safety locks" preventing you to mess around freely with the network, the packet is nothing more than a binary stream, which can have any source address and any destination address. The network devices will receive that and decide what to do with the information they have. A router can take any packet and forward it, with translations or whatnot, to wherever it decides too.

Also consider that routing happens as you send an IP packet, with an external destination on the layer 3 header, to the mac address of your router. A layer 2 device (a simple switch) won't check the IP header, just the mac to which it should forward the packet to. As long as it sends the packet to the right port it will eventually reach the router somehow. The router then will be able to forward it further.

Assuming that the network is set up accordingly, all you need is to make sure that the packet leaves your computer from the right interface. You can do it by creating a route to the gateway network, through one of the interfaces first, then routing whatever you want to that gateway.

the practice

The following ip commands should do that for you (sorry unix guys, I'm still mostly on linux only and even forgetting stuff about ifconfig):

ip route add 10.100.0.1/32 dev eth0 src 10.100.10.99
ip route add default via 10.100.0.1

the disclaimer

Just let me enforce that I'm strictly staying out of a best practices discussion here. I'm not a network engineer and far from comfortable in discussing that, it just seemed to be useful to others to share the way I know it can be achieved.

2
  • Really nice to know this .... Thanks.
    – MarcoZen
    Feb 4, 2021 at 15:42
  • I'm looking for how can do this using neutron dhcp server.
    – cybercoder
    Sep 12, 2021 at 15:17
2

It is possible, but as explained in the linked article your machine must already know how to get to the gateway address. This means that you will need to use post-up to manually add the routes instead of gateway

iface eth0 inet static
  address 10.100.10.99
  netmask 255.255.255.0
  post-up ip route 10.100.0.0/24 via 10.100.10.x # router that can route you to the 10.100.0.0/24 network
  post-up ip route 0.0.0.0 via 10.100.0.1
1
  • 2
    These ip route commands will fail if you try them... even if you add the missing add command.
    – Jander
    Oct 31, 2013 at 22:15
2

I'm having the same problem at multiple locations with Verizon ADSL service. The "default gateway" is on a different subnet. In our case, we need public IP addresses in order to use an ipsec site-to-site vpn. In order to do that, we need to place the DSL gateway into bridge mode, so that the public IP address is on our router instead of the DSL gateway.

Most providers are able to do this fairly easily, but Verizon seems to have difficulty. Using a D-Link 2750B DSL gateway, placing it in bridge mode, the Verizon techs are telling me to use the default gateway on a separate subnet. I tested it using my Windows 7 laptop and although Windows gives an error message to the effect that, "You're an idiot and this is a bad idea - do you STILL want to save this configuration? Yes/No," it does operate.

However, software with more stringent sanity checks seem to protect you from yourself...

Still, I can't help but think there's got to be a way to fake it out...

0

The reason your gateway has to be in the same prefix as your host is that in order to construct a packet towards the gateway, you also need to know the MAC address of the gateway. If your gateway is outside your prefix, then the system is not even going to attempt to ARP or NDP to find the MAC.

Side note: I think the interface subnet mask is only used to generate a route for L2 switching like 192.168.1.0/24 dev enp1s0 proto kernel scope link src 192.168.1.2 metric 100 Even if your netmask is changed to something non-sensical if you still have this route correct it should be fine.

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Mar 3 at 5:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.