What does a routing table mean? When the VPN is disconnected, the computer can't access the internet. When I checked the route print, the extra line was the real culprit
last week, I went on a business trip and spent about forty minutes on the company VPN modifying the material. After finishing the work, I logged out of the VPN and wanted to look up some information. I spun web pages, circled on WeChat, all of them. I thought to myself, is the hotel network acting up again? I pinged the gateway of the router at home to 192.168.31.1, it worked, and not a single package was lost. Ping again 223.5.5.5, sinking into the sea.
gateway is open, but the external network is completely disconnected. This half-normal, half-down-down problem is answered by a single command: route print. I checked and found that in my router table, there were two lines starting with 0.0.0.0.
routing table isn't exclusive to routers; you have one on your computer
many people hear the routing table and think it's something that only exists inside the router. Actually, as long as this device can access the internet, it has one—Windows, Mac, phone, even my NAS at home, it has it all. The reason it's called a router is because it checks this table the most frequently, nothing more.
the task of this form is summed up in one sentence: every time the device sends a package, it first checks where the package is going, then checks the table to decide who to transfer it to. Every place you go to is reviewed in this form before you set out, but you don't know.
Where did
get this watch in the computer? You don't need to worry about it most of the time. When DHCP sends you the IP address, it also tells you the gateway, and the system generates a default route pointing to that gateway (I've written DHCP about the automatic address issuance process in an article ). The router's table is automatically generated after the WAN port dials successfully. Both sides are automatic, so you don't usually notice their presence—until one day something that shouldn't have appeared inside the surface.
Windows command to check your own table is route print. Start menu, search cmd and press Enter, enter it, and a large screen will appear. Don't be scared—the real useful part is the middle part, titled 'Event Routing.'
the three columns inside and outside are the skeleton: where to go, how large the area, and who to hand it over
route print output has five columns. The first three columns are the skeleton. I'll first take a table from my own computer that works normally for you to break down:
| list | plain language | the example on my machine |
| Network Destination | where is this batch of bags going | 0.0.0.0 indicates all places |
| Netmask | and the above destination circles the area; | 255.255.255.0 indicates a building |
| Gateway | hand over the bag to and transfer it | 192.168.31.1 is the main router at home |
| Interface | which network card to use to leave | wired or wireless network card |
| Metric | the travel fee for that route, The smaller the | , the more prioritized it is |
Destination and Netmask are partners—one reports the place name, the other the range (I the algorithm for masking segments I in the subnet mask section). 192.168.31.0 paired with 255.255.255.0 means "all address numbers in this building 31.x"; 0.0.0.0 plus 0.0.0.0 means 'everywhere counts.'
Gateway there are two ways to write that column, and the difference is crucial. Write your own network card's IP and mark it as On-link, meaning "The destination is on the same network segment as me, no need to ask anyone, I'll just call their name"—calling the name is ARP broadcasting (ARP the case where the NAS intermittently switched was called by the wrong person). It is written as someone else's address like 31.1, meaning "I can't reach this place, so let the gateway handle it for me" ( gateway is the gateway you need to pass through when you leave; if you're unclear, please fill in this ).
under normal conditions, a home computer's routing table is simplified to just three lines: the 127.0.0.1 line is used by the machine to communicate itself; the two lines 192.168.31.0 are used to visit people inside the building; and the 0.0.0.0 line is for exiting the building and pointing to the gateway. Three lines support all your online traffic.
lookup is not top-down; it's the "most concrete win"
this chart has a temper: it doesn't search in order from top to bottom, but rather, among all matching entries, the narrower and more specific the scope is the one who gets the final shot. In jargon, it's called the longest prefix match; just remember the "most specific win."
send a package to 192.168.31.5 to the computer. The entry for the building in 31.0 matches the 0.0.0.0 safety net, and so does the one with the safety net. The former is more specific: listen to the former, send directly on-link without alerting the gateway.
send a package to 223.5.5.5. Entries in the thread can't be included, only the 0.0.0.0 bottom basket can be stored. If you go, the bag will be handed over to 31.1. This backup router is the default route, and the word "default" in the name is for this purpose: if no one claims the package, just stuff it into it.
So what happens if you manually enter the IP and forget the gateway? Now you can go out: the 0.0.0.0 entry is no longer in the table. Ping is possible on the same subnet—On-link packet delivery does not rely on the gateway; Once you leave the network, no one picks up, and the package is left rotten in your hands. This is the same logic as the situation of manually matching IPs for self-rescue in the 169.254 article but different tools, but the same principle.
My Crash Scene: The Line Where VPNs Refuse to Leave
returned to the night of the business trip. Route print, and sure enough, the 0.0.0.0 line has two lines:
0.0.0.0 0.0.0.0 10.12.60.13 10.0.0.0 0.0.0.0 192.168.31.1 25
company connected to the VPN, they built a virtual network card for themselves, configured a 10.x subnet, and then inserted a new default route into the routing table, labeling the fee metric as 1. Multiple roads to the same destination, whoever takes the smaller route is the rule. When a VPN is in place, this is perfectly fine—global VPNs are designed to tunnel all traffic, so it's normal for them to steal it.
problem lies in disconnection. The virtual network card was gone, and the default route it had inserted was still stuck in the table. All my packages for leaving the building are still sent to the now-defunct address 10, 12, 60, and 13, but once I leave, there's nothing more. But when visiting people in the building and using On-link, they don't check the default route at all, so ping the gateway 31.1 works as usual—this is the most frustrating part of this fault: the symptoms are half normal and half down, and if you just stare at the gateway, you'll never figure it out.
fix it with just one command: route delete 0.0.0.0 mask 0.0.0.0 10.12.60.13, press Enter, and the webpage will pop up instantly. After that, after I canceled the company VPN, I had a habit: I scanned the route print, checked how many 0.0.0.0 remained, and deleted any more—it only took ten seconds.
three things that really allow you to use a router at home
first item, bypass is a test run. If you want a computer to experience the filtering effect of a bypass router but don't want the whole family to gamble without using the router, switch its default router from the main to the bypass on this computer—in other words, it's the manual gateway modification step. A more stable approach is to add only one more specific route, letting one segment of traffic use a bypass route, while the rest remain the same, minimizing the cost of trial and error (I've a of bypass routing connections and pitfalls). This is two different views from my previous advocacy of 'testing equipment for a week before the overall situation.'
second item: plug in the network cable and turn on WiFi. At this point, there are two default routers in the table, each using their own network card, and the metric is to listen to whom. Cable fares are generally lower, so cable is preferred; When you unplug the cable, the meter automatically requeues and switches data to WiFi, with no interruption in between. The "seamless switching" you've experienced is exactly the watch in action.
the third item, the first jump of tracert. Tracert baidu.com, the first hop is always your default gateway. If you ever find that the first IP jump isn't your router's IP, don't rush to blame the ISP. Most likely, there's another layer of devices dialing in between ( how to tell who dials up—I wrote about in the dial-up article), or maybe VPNs or similar things have secretly changed your list.
three commands in one order, wrapping up the
use these three points daily:
| commands | what to do | pay attention |
| route print | check the watch | focus on those lines at 0.0.0.0 |
| route add target mask Gateway | add a line | end with -p to restart so you don't lose |
| route delete target mask Gateway | delete a single item | If deleted incorrectly, restart and the table will be rebuilt |
Mac and Linux have different names. Mac uses netstat -rn for checking tables, while Linux uses ip route show. The approach is exactly the same, so I won't take up space here.
gateway's role in this table should now be fully three-dimensional: it is the next hop after the default route. The phrase "If the gateway is incorrectly filled in, it can't access the external network" translates to routing table language, meaning your package was sent to the wrong reseller. Next time you can't get online, follow this order: first ping the gateway for triage. If it works, check the route print for a few entries in 0.0.0.0, delete any extra; if that doesn't work, check in the DNS direction. After three layers of screening, 90% of those who "can't get online" can be targeted at specific links.
