I have two subnets.

The Cloudprovider(Hetzner) gives me a gateway for the subnet I have a windows client in this subnet. I have a Mikrotik/Firewall/Gateway on in subnet

If i use on the default gateway I can ping and the other way around.

But I want to be the default gateway.

I tried these routes on the windows client: via via


But its not working. What am I missing?

  • If the traffic is not going to, what destination is it attempting?
    – Greg Askew
    Feb 12, 2022 at 19:22
  • @GregAskew With routes added in the image: ping ends with host not reached
    – Wulf
    Feb 12, 2022 at 19:30
  • That's what I would expect. The interface is on a different subnet than That isn't a valid next hop for a router.
    – Greg Askew
    Feb 12, 2022 at 20:14
  • @GregAskew So I have no possibility to use as Default Gateway, because I have no direct interface in that subnet?
    – Wulf
    Feb 12, 2022 at 20:30
  • 1
    @Wulf You cannot use a gateway that is in another subnet. Either you use the gateway in your subnet or you move over to the other subnet.
    – Zac67
    Feb 12, 2022 at 22:09

1 Answer 1


A gateway can only be used when it is located in the same subnet as the sender. IP routing works by sending an IP packet to the gateway and the gateway forwarding it on.

On MAC-based networks like Ethernet that is done by addressing the encapsulating Ethernet frame to the gateway's MAC address. The MAC address is determined by an ARP request for the gateway IP address. ARP uses Ethernet broadcast to send the request to all nodes in the broadcast domain. Accordingly, a gateway MUST be located within the sender's broadcast domain.

Usually, the sender only attempts to ARP the gateway address when it is part of its own subnet. You could trick this part by forcing an address to be "on-link" (similar to what you've tried) but you can't trick the broadcast domain.

Forcing a gateway that your local gateway should use was initially an IP option called source routing. It didn't gain wide adoption and is today generally deprecated for severe security issues. The option is either ignored or the whole packet is dropped.

As mentioned in the comment: you need to use your local gateway or move the host to the other subnet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.