Default routes and the black holes they create

A default route is the instruction to forward anything you have no specific route for. It is essential and it is also how traffic disappears without a trace.

The black hole

A router with a default route will never say “destination unreachable” for an internal prefix, because it always has somewhere to send the packet. Delete a route to a real internal network, and instead of a clean failure, traffic is forwarded up the default towards the internet, where it is dropped by someone who has no idea what it was.

The symptom is a timeout rather than an error, which sends people looking at the destination instead of the router that lost it.

Finding it

traceroute 10.50.1.1
# if internal traffic heads towards your internet gateway,
# the specific route is missing

That single observation — internal traffic leaving through the default — identifies the fault immediately, and it is visible in one command.

Discard routes

The defence is a summary route to null for address space you own:

ip route 10.0.0.0 255.0.0.0 Null0 250

Now traffic to any unallocated part of your own space is dropped locally with an unreachable message, rather than being sent to the internet. You get a fast, honest failure and a clear message, and you stop leaking internal traffic to your provider.

Longest-prefix match already keeps the more specific routes ahead of it; the high administrative distance only stops the discard route displacing a real 10.0.0.0/8 learned from a routing protocol.

Two defaults

Two default routes with equal cost will load-balance, which is rarely what anyone intended for internet access with stateful firewalls in the path. Make the preference explicit, and verify the backup with a tracked object rather than assuming an interface being up means the path works.

The habit

When traffic vanishes, check whether it is following the default. It is a two-second check and it separates “no route” from “wrong route”, which are different problems with different fixes.