Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I want to forbid a route to response a network, should I use ip route add unreachable or ip route add prohibit

share|improve this question
Do you want to tell people trying to access them that they are unreachable (no route)? Or do you want to tell people trying to access them that they are prohibited from reaching them (administratively prohibited)? It's up to you what error you want to give. – David Schwartz Apr 17 '12 at 10:45
up vote 2 down vote accepted

The router will legitimately give back UNREACHABLE whenever it doesn't have a route to the destination.

PROHIBITED is probably the better practice to go with. If you get into the habit of setting unreachable, it may cause confusion down the line when you're troubleshooting why your router is giving back responses saying it can't route the packet, when it really should be saying it won't route the packet.

share|improve this answer

Eventually, both of them will disable reaching the indicated host/network as both of them are types of ICMP unreachable errors. The main difference is the meaning you want to tell to network users.

share|improve this answer

Prohibited means that the user can physically connect but isn't allowed to.

Unreachable means that the user can't connect at all.

So which you report depends on what you want to tell your users.

Do you want them to know that the IP is valid, but they don't have the necessary permissions to connect or do you want to effectively make the IP invisible?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.