A "Gateway Unreachable" error means your device has an IP address but cannot reach the router that forwards traffic off the local subnet. Fix it by verifying the assigned gateway with ipconfig or ip route, pinging that address, flushing ARP, and correcting DHCP, routing, or firewall rules blocking the path.
Symptoms
- Ping to the default gateway returns "Request timed out" or 100% packet loss
- Websites fail to load while local file shares and printers still work
- Windows shows "No internet, secured" but a valid IPv4 address is assigned
- tracert stops at the first hop or never leaves the local subnet
- APIPA address (169.254.x.x) appears instead of the expected LAN range
Common Causes
Wrong or missing default gateway
The gateway field is blank, points to an address on a different subnet, or was set manually to an outdated router IP after a network change.
DHCP scope or lease problem
The DHCP server handed out a stale lease, ran out of addresses, or is pushing an incorrect Option 3 (Router) value. Devices then hold an unusable gateway.
Duplicate IP or stale ARP entry
Two devices claim the same address, or the ARP cache maps the gateway IP to a wrong MAC. Traffic is silently sent to the wrong host.
Local firewall or endpoint security
Windows Defender Firewall, iptables, or a security agent blocks ICMP and ARP replies from the router after a profile switch to Public.
Router, VLAN, or cabling fault
The gateway interface is down, the port is assigned to the wrong VLAN, or a bad cable/SFP prevents the client from reaching the router at layer 2.
Step-by-Step Fix
- Confirm the fault with ipconfig and a targeted ping
Open an elevated Command Prompt on Windows and run ipconfig /all, or use ip addr and ip route on Linux/macOS. Note the Default Gateway value, then run ping <gateway IP>. Loss on every packet confirms the gateway path is broken rather than DNS or upstream ISP. - Check the gateway lives on your subnet
Compare the IP address, subnet mask, and gateway. With 192.168.10.50/24 the gateway must be 192.168.10.x. A gateway outside the mask range is unreachable by definition. Fix a wrong static entry, or release and renew DHCP with ipconfig /release and ipconfig /renew. - Flush ARP and DNS caches
Stale layer-2 mappings survive router reboots. On Windows run arp -d * and ipconfig /flushdns from an admin prompt. On Linux use ip neigh flush all. Retest the ping. If a fresh ARP request now resolves the gateway MAC, connectivity usually returns. - Test layer 2 and the physical link
Look at the switch port LED and NIC status. Swap the patch cable, try another port, and disable then re-enable the adapter. On Wi-Fi, forget and rejoin the SSID to rule out a stuck association. A link at 10 Mbps half-duplex often signals a cabling fault. - Rule out the local firewall and security software
Temporarily set the Windows Defender Firewall profile to allow inbound ICMPv4 Echo Reply, or stop the endpoint agent briefly for testing. If the ping succeeds only with the firewall off, keep the firewall on and add a specific rule for the gateway subnet instead of disabling protection. - Inspect the routing table and add a default route if missing
Run route print on Windows or ip route on Linux. You need a 0.0.0.0/0 entry pointing to the gateway. If it is absent, add it: route add 0.0.0.0 mask 0.0.0.0 192.168.1.1 on Windows, or sudo ip route add default via 192.168.1.1 on Linux. - Verify the router side
Log in to the router's admin interface from a working device. Confirm the LAN interface is up, DHCP is enabled with the correct scope and Option 3, and no ACL blocks the client VLAN. Reboot the router only after capturing its current config, so you can restore settings if needed. - Escalate to VLAN, trunk, or ISP checks
If multiple clients on the same VLAN fail but another VLAN works, inspect the switch trunk and the router sub-interface for that VLAN. If every client is offline and the WAN light is dark, contact the ISP with your modem's sync statistics before replacing hardware.
Quick diagnosis: symptom to likely cause to first action
| Symptom | Likely cause | First action |
|---|---|---|
| 169.254.x.x address assigned | DHCP server not reachable | Check switch link, restart DHCP service, renew lease |
| Gateway field is blank | Static config missing gateway | Set gateway or switch adapter to DHCP |
| Ping to gateway times out, ARP resolves | Firewall or router ACL blocking ICMP | Review firewall profile and router access rules |
| Ping fails and ARP shows incomplete | Layer 2 or VLAN problem | Verify cable, switch port, and VLAN assignment |
| Only one device affected | Local NIC or duplicate IP | Change IP, update NIC driver, check for conflicts |
| All devices on one VLAN affected | Router sub-interface or trunk down | Inspect router VLAN config and switch trunk |
Prevention
- Reserve gateway-critical devices with DHCP reservations tied to MAC addresses
- Document static IP assignments and review them after every subnet change
- Monitor gateway reachability with a simple ICMP check from a management host
- Keep router firmware and endpoint security policies on a scheduled review cycle
FAQ
Why can I ping other local devices but not the default gateway?
Your layer 2 network is healthy, so the issue sits at the router or in the path to it. The router's LAN interface may be down, an ACL may block your VLAN, or your ARP cache holds a wrong MAC for the gateway. Clear ARP, then check the router interface and firewall rules.
Is a 169.254.x.x address the same as "Gateway Unreachable"?
Not exactly, but the symptom overlaps. An APIPA address means DHCP failed entirely, so no gateway was assigned. The device cannot leave the local link. Restore DHCP reachability by checking the switch port, cabling, and DHCP server or router service before troubleshooting the gateway itself.
Should I set a static IP to work around a gateway problem?
Static addressing is useful for diagnosis, not as a permanent fix. It can mask the real fault and cause duplicate-IP issues later. Use a static config to prove the gateway responds, then repair DHCP or the routing configuration so every client gets a correct, managed address.
Need hands-on help restoring gateway connectivity across your network? Contact our IT support team for a structured diagnosis.