VPN is disconnected, the extra line in route print is the real culprit
Last week on a business trip, the company's VPN changed the data for about 40 minutes. After finishing the work, I log out of the VPN. If I want to check some information, I will circle the web page, circle WeChat, etc. I thought the hotel network was having trouble again? I pinged the gateway of the router at home. 192.168.31.1 , it works, not a single package was lost. ping again 223.5.5.5 , sink into the sea.
All gateways are connected, but all external networks are disconnected. The answer to this half-normal and half-paralysis problem is found in a single command.: route print . I typed it out and found that in my routing table, 0.0.0.0 There are two lines in the beginning.
The routing table is not exclusive to the router. There is one in your computer.
When many people hear routing tables, they think they are something only found in routers. In fact, as long as this device can access the Internet, it has one - Windows, Mac, mobile phone, and my NAS at home, all of them. The reason why a router is called a router is because it checks this table most diligently, that's all.
The task of this table can be explained in one sentence: Every time the device sends a packet, it first checks where the packet is going, and then looks up the table to decide who to hand it over to. Everywhere you go, you go through this list before setting off, but you don’t know it.
Where did this table come from in the computer? Normally you don't have to worry about it. When DHCP sends you the IP, it also tells you the gateway, and the system will generate a default route pointing to that gateway ( I have written an article about DHCP’s process of automatically issuing house numbers. ). The router table is automatically generated after the WAN port dial-up is successful. Both sides are automatic, so you don't feel its existence at ordinary times - until one day there is something in the watch that shouldn't be there.
The command to view this table under Windows is route print. Search cmd in the start menu and press Enter, type in, and a large screen will appear. Don't be scared, the really useful part is the middle section, titled "Activity Routing".
There are only three columns in the table which are the skeleton.: Where to go, how big the scope is, and who to hand it over to?
The output of route print has five columns. The first three columns are the skeleton. I will first take the normal state table on my computer and disassemble it for you.:
| List | vernacular | Example on my machine |
|---|---|---|
| Network Destination | Where are these bags going? | 0.0.0.0 means everywhere |
| Netmask | How much area is circled by the destination above? | 255.255.255.0 means to circle a building |
| Gateway | To whom does the bag change hands? | 192.168.31.1 It’s the main router at home |
| Interface | From which network card? | Wired network card or wireless network card |
| Metric | The smaller the toll on this road, the higher the priority. | Wired are generally smaller than wireless |
Destination and Netmask are partners, one reports the place name and the other reports the range ( I have discussed the algorithm for masking network segments in the article on subnet masks. ). 192.168.31.0 Served with 255.255.255.0 , meaning "31.x All house numbers in this building」 ； 0.0.0.0 Served with 0.0.0.0 , meaning "all places count".
There are two ways to write the Gateway column, and the difference is crucial. What is written is the IP of your own network card, marked On-link, which means "the destination is on the same network segment as me, no need to ask anyone, I will just call him by name" - the action of calling the name is ARP broadcast ( In the ARP article, the case where the NAS was on and off was because the wrong person was called. ). It's someone else's address like 31.1, which means "I can't reach this place, let the gateway forward it for me" ( The gateway is the door you have to go through when going out. If you don’t have a clear idea, please read this first. ).
Under normal conditions, the routing table of a home computer is reduced to three lines.: 127.0.0.1 That one is used by this machine to talk to itself. ； 192.168.31.0 Those two buildings visit each other ； 0.0.0.0 That pipe goes out of the building and points to the gateway. Three lines can support all your Internet traffic.
The table lookup is not from top to bottom, it is "the most specific result"」
This watch has a temper: It does not search from top to bottom in order, but among all the matching items, who has the final say whose scope is smaller and more specific. The jargon is called longest prefix matching, and you just need to remember "the most specific wins".
Send one to the computer 192.168.31.5 package. The entry for that building 31.0 matches, 0.0.0.0 The one with the bottom also matches. The former is more specific, listen to the former, On-link sends it directly without alerting the gateway.
Send one to 223.5.5.5 package. None of the entries in the building can be matched, only 0.0.0.0 That bottom basket can be loaded, so take it and leave the bag to 31.1. This covert route is the default route. That’s what the word “default” in the name is for.: If there is really no one to claim the bag, all the bags will be stuffed into it.
So what will happen if you manually fill in the IP and forget to fill in the gateway? Now you can push it out.: Not inside or outside 0.0.0.0 That's it. You can still ping on the same network segment - On-link packet delivery does not rely on the gateway ； As soon as it left the network segment, no one answered it, and the package was ruined in my hand. This is similar to 169.254 The situation of manual IP allocation and self-rescue in the article It’s the same set of logic, different tools, and the same principle.
My car rollover scene: That line of work that VPNs can’t get out of
Back to the night of the business trip. route print is printed, 0.0.0.0 There are indeed two lines in that line:
0.0.0.0 0.0.0.0 10.12.60.13 1
0.0.0.0 0.0.0.0 192.168.31.1 25
When the company's VPN was connected, it created a virtual network card for itself, assigned a 10.x network segment, and then inserted a new default route into the routing table, with the toll metric marked as 1. There are multiple roads to the same destination. Whoever takes the smaller route should take it. This is the rule. There is nothing wrong with doing this when a VPN is available - the global VPN is designed to tunnel all traffic, so it is normal for it to take away traffic.
The problem is disconnection. The virtual network card is gone, and the default route it plugged in is still there. All my bags that left the building are still going in 10.12.60.13 If you send it to this address that no longer exists, there will be no further information. When using On-link in the building, the default route is not checked at all, so pinging gateway 31.1 still works - this is the most annoying part of this fault.: The symptoms are half normal and half paralyzed. You will never understand it just by staring at the gateway.
Just one line of command: route delete 0.0.0.0 mask 0.0.0.0 10.12.60.13 , press Enter, and the web page will pop up on the spot. After that, I had a habit of logging out of the company’s VPN and scanning the route print. 0.0.0.0 There are a few left. If there are too many, delete them. It only takes ten seconds.
By the way, the VPN route I use at home to play at home ( I ran through the three roads connecting NAS outside. ) is specially equipped with the split mode: Only one 31.x network segment is added to the table to point to the tunnel, and the default route is still the local gateway. Even if one day it is disconnected and the remaining parts are left, only the section at home will be wasted, so the overall situation will not be paralyzed. Thinking a little more when installing a VPN will save you the trouble of repairing it if it breaks.
Three Things You Can Really Use Routing Tables at Home
The first thing is to test the bypass water. If you want a computer to try the filtering effect of a bypass route first, but don’t want the whole family to gamble, you can change the next hop of its default route from the main router to a bypass route on this computer without touching the router. To put it bluntly, this is the step of manually changing the gateway. A more stable approach is to only add a more specific route, let a certain section of traffic go through the bypass route, and keep the rest as usual, minimizing trial and error costs ( I have stepped on the bypass route and its pitfalls once. ). These are two different ways of saying the same thing as my idea back then of "first leveling the equipment and testing it for a week before taking a look at the overall situation."
The second thing is to plug in the network cable and turn on WiFi. At this time, there are two default routes in the table, each using its own network card, and the metric is ignored. Cable tolls are generally lower, so cable is preferred. ； As soon as you unplug the network cable, the table will automatically rearrange and the traffic will be switched to WiFi without interruption in the middle. The "seamless switching" you have experienced is the table flipping underneath.
The third piece, tracert’s first jump. tracert baidu.com , the first hop is always your default gateway. One day you find that the first hop is not the IP of your own router, don’t blame the operator first, it’s probably because there is another layer of equipment in the middle that is dialing ( How to tell who is dialing I wrote about it in the dialing article ), or something like a VPN secretly changed your watch.
Three commands in one order, ending
These three items are enough for daily use:
| Order | what to do | Things to note |
|---|---|---|
| route print | Look at the watch | Focus on 0.0.0.0 those lines |
| route add target mask mask gateway | add one | Add -p at the end to restart so that nothing is lost. |
| route delete target mask mask gateway | Delete one | If you make a mistake in deletion, restart and the table will be rebuilt. |
Mac and Linux have different names. Mac looks at the table: netstat -rn ,Linux is ip route show , the ideas are completely consistent, so they don’t take up space.
The status of the gateway in this table should now be completely three-dimensional.: It is the next hop of the default route. 「The gateway is filled in incorrectly and cannot connect to the external network." This sentence is translated into routing table language, which means that your packet was sent to the wrong transfer person. Next time you are unable to connect to the Internet, follow this order: First, ping the gateway for triage. If the connection is successful, use route print to check. 0.0.0.0 There are a few, the extra ones will be deleted. ； Not yet, keep going DNS direction to check . After three layers of sifting, 90% of the "cannot get online" can fall into a specific link.
