Why can't I add a route with a different gateway?

I'm using Linux Centos 7/8.

• The main network is 92.168.0.1/24
• The server has 192.168.0.70

The server is connected to a switch that provides me access to a different subnet.

I would like to access a different subnet 10.50.0.0/24 using its gateway 10.50.0.254 but due to a requirement, I need to set the source IP as 172.16.0.10

For that, I assign a second IP 172.16.0.10 to the eno0 interface.

Adding the IP isn't the problem: ip addr add 172.16.0.10 dev eno0

Nevertheless, adding the route ip route add 10.50.0.0/24 via 10.50.0.254 src 172.16.0.10 returns RTNETLINK answers: Network is unreachable

What's strange is I don't see the ARP with tcpdump... How does it know the network is unreachable?!

Why? How can I add this route?

1 Answer

How does it know the network is unreachable?!

Because you don't yet have a direct route to 10.50.0.254. The system doesn't know which interface to use to reach the gateway itself.

You need to specify the gateway's other address – the one that's in your subnet. (A gateway will have multiple addresses, one from each network that it belongs to.)

• For example, if you are 192.168.0.70/24, and the gateway has 192.168.0.50/24 on its one interface and 10.50.0.254/24 on another, then your route would need to be:

  ip route add 10.50.0.0/24 via 192.168.0.50

• If the gateway is physically on your layer-2 network but for some reason doesn't have an address from your subnet (let's say if you have 2 different subnets sharing the same VLAN), then use whatever address it has, as long as that address is on your side.

  In this case, you'll need to specify the onlink flag to force Linux to accept the route, or alternatively add a device route for that address first. (Sometimes an address from any interface will work, but not all gateways respond to ARP requests for the "wrong" interface's IP addresses.)

  Let's say your ethernet concurrently has 192.168.0.0/24 and 192.168.5.0/24 for some reason, and you are 192.168.0.70 but want to use a gateway which is 192.168.5.50. This can be made to work:

  ip route add 10.50.0.0/24 via 192.168.5.50 onlink dev eno1

  Older kernels do not recognize the 'onlink' flag for IPv4 (it was originally added for IPv6) so they would need two routes, the first one a "direct" route declaring the gateway itself (or the whole subnet) as on-link:

  ip route add 192.168.5.50/32 dev eno1
  ip route add 10.50.0.0/24 via 192.168.5.50

• If the gateway is physically on your layer-2 network but for some reason doesn't have any IPv4 addresses on your side, it's possible to specify an IPv6 address as the gateway... so long as it gets resolved to the same layer-2 address:

  ip route add 10.50.0.0/24 via inet6 fe80::a1:b2c3 dev eno1

• Finally, if the gateway isn't physically in your network... then there's no way to add a direct route through it, because routes work by changing layer-2 addresses.

  You can only route through gateways which are physically in your network, and those gateways – not you – decide where to send the packet further. (A tunnel is sometimes an option to get around this restriction, but the remote gateway has to be explicitly set up to receive tunnelled packets.)

  (There are "source routing" and "segment routing" systems which add exceptions to this rule but they aren't generally part of basic IP networks.)