This turns out to be harder than I thought. The routes I want to delete are the "!" rejected routes, but I can't seem to formulate the right "route del" command to pull it off.

Here is the routing table...

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   *      UH    0      0        0 ppp0   *      UH    0      0        0 ipsec0   -      !H    2      -        0 -     *        U     0      0        0 eth0        *          U     0      0        0 ipsec0        -          !     2      -        0 -
default         *              U     3      0        0 ppp0
default         *              U     4      0        0 ppp0

I have two entries for and These are auto-generated by the little Linux based router I'm using. I can ping the IPSEC tunnels from the shell itself, but traffic from the LAN takes the second route (the rejected "!" or "!H" route) for reasons I simply don't understand.

  • Can you be more specific when you say traffic takes the 'second route'?
    – Zoredache
    Sep 14, 2010 at 18:18
  • Notice the two table entries for At the router shell, if I ping that side of the tunnel it works. From the LAN-side, traffic goes to the "second" entry and is rejected/drops.
    – user54259
    Sep 14, 2010 at 19:52
  • I also don't understand why the SG560 generates two (2) table entries for "default" and the IPSEC destinations. I'm perplexed.
    – user54259
    Sep 14, 2010 at 19:53

6 Answers 6


with the route -n command you'll obtain

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    0      0        0 eth0         UG    600    0        0 wlan0

sudo route del -net gw netmask dev eth0

you'll get all parameters respectively from above

  • 4
    After reboot, it again comes . How can I delete permanently ? Jan 14, 2019 at 9:17
  • 1
    @shyamkkhadka it depends from which process it has been created... recommend you to post a question with your specific case to analyze it. Give details about the route you got and want to remove. Mostly the dhcp server and client will create the routes Jan 14, 2019 at 10:37
  • what if the gateway is - ?
    – birgersp
    Jan 6, 2023 at 10:34
  • Is there a delete-everything command? docker has created so many and I can't be bothered typing this in every time I need to use the internet (it conflicts with vpns, lans, everything).
    – jozxyqk
    Aug 14, 2023 at 20:10
  • @jozxyqk not that I know of, you'd have to awk the result of the route -n and play with that into a while read line. That's how I'd do that. Aug 16, 2023 at 21:35

The types of the routes with the ! flag are either unreachable or prohibit. route, being an ancient utility from net-tools, does not differentiate between the two. Use iproute2.

The net-tools way to delete these routes would be to use route del on it. However, net-tools provides no way to differentiate between the rejected route and the other one (because the dev argument is optional, though not specifying a device is likely to remove the unreachable route).

iproute2 allows you to do it like this:

ip route del unreachable
ip route del unreachable

It might not be unreachable, but prohibit. Use ip route with no arguments to determine which.


I think it's this: route del -net netmask metric 2

I'm not 100% certain. But, I think you've got something else goofy going on since you have 2 default routes.

  • 2
    +1 : 2 default routes is always a sign of something being misconfigured (unless they actually point to different gateways and have different metrics).
    – wolfgangsz
    Sep 14, 2010 at 21:20

From my experience,

route del -host <ip> reject

should work. In your specific case,

route del -host reject

should do the trick. Please note that this applies to routes I manually added. I'm not entirely certain why yours has duplicate routes without interfaces. As such, it may be necessary to apply a metric parameter, as described by baumgart.


All the time someone try to hack me and i afraid to be bridged. I use VPN and adress is from it. Is that route ok?

pek@pop-os:~$ route -n

Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface UG 50 0 0 tun0 UG 20100 0 0 enx001e101f0000 U 50 0 0 tun0 UGH 50 0 0 enx001e101f0000 U 1000 0 0 enx001e101f0000 U 100 0 0 enx001e101f0000 UH 50 0 0 enx001e101f0000


Please see if there is a "device config file" under /etc/network/interfaces.d/ -> I had eht0!! Really, it was eht0 and not eth0 there!

  • You might want to expand your answer somewhat, as it is not obvious at present how it relates to the question being asked.
    – womble
    Mar 15, 2019 at 6:00

You must log in to answer this question.