If I want to forbid a route to response a network, should I use ip route add unreachable or ip route add prohibit

  • Do you want to tell people trying to access them that they are unreachable (no route)? Or do you want to tell people trying to access them that they are prohibited from reaching them (administratively prohibited)? It's up to you what error you want to give. – David Schwartz Apr 17 '12 at 10:45

The router will legitimately give back UNREACHABLE whenever it doesn't have a route to the destination.

PROHIBITED is probably the better practice to go with. If you get into the habit of setting unreachable, it may cause confusion down the line when you're troubleshooting why your router is giving back responses saying it can't route the packet, when it really should be saying it won't route the packet.


Eventually, both of them will disable reaching the indicated host/network as both of them are types of ICMP unreachable errors. The main difference is the meaning you want to tell to network users.


Prohibited means that the user can physically connect but isn't allowed to.

Unreachable means that the user can't connect at all.

So which you report depends on what you want to tell your users.

Do you want them to know that the IP is valid, but they don't have the necessary permissions to connect or do you want to effectively make the IP invisible?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.