Two subnets in one private network reach the internet differently — which route table decides that for each subnet?

## What a route table actually is A route table is a set of entries, each pairing a **destination prefix** with a **target** — the door a packet matching that prefix leaves by. Typical targets are local delivery inside the network, the network's internet-facing attachment, an address-translating gateway, a link to another network, or a dedicated circuit. Two rules govern it, and both are worth stating explicitly in an interview: - **Association decides which table applies.** A subnet has one effective table. Either you associated one with it, or it uses the network's default — and which of those two is the norm differs by platform, which is exactly why you check rather than assume. - **Longest match decides which entry applies.** The table is not evaluated top to bottom. Every entry whose prefix contains the destination is a candidate, and the most specific one wins. The default route, covering all destinations, is therefore the fallback that catches whatever nothing else matched. ## Why two subnets in one network diverge They diverge because association is per subnet, which is the whole point of the design. A common estate has three shapes in one address range: 1. **A routed subnet** whose table sends unmatched destinations to the network's internet-facing attachment. Workloads here can be reachable and can call out directly. 2. **A translated subnet** whose table sends unmatched destinations to an address-translating gateway. Workloads here call out but cannot be called. 3. **An isolated subnet** whose table carries only the local range. Nothing leaves. Same network, same address plan, three different behaviours — decided entirely by which table each subnet is associated with. That is also the failure mode: a new subnet created without an explicit association silently inherits the network's default table, and whether that default is permissive or bare differs by platform. ## Diagnosing a divergence When two subnets should behave alike and do not, work in this order: 1. **Which table is effective for each subnet?** Not which table someone edited — which one is actually associated. Editing the wrong table is the single most common cause of a change that appears to do nothing. 2. **Do the entries differ?** Compare them side by side, including the more specific ones. A single extra entry for one partner's range sends only that partner's traffic somewhere else, which is why the symptom is often absurdly narrow. 3. **Is the target itself healthy and reachable?** A route pointing at a gateway whose own subnet has no outward route is a valid entry to a dead end. ## The blast radius of a shared table One table associated with many subnets is convenient and is a shared fate: an entry added for one team's partner integration changes the exit door for every subnet associated with it. A route table has a finite number of entries on every platform, so a shared table also accumulates toward that ceiling. Splitting tables by **routing intent** — routed, translated, isolated, partner-facing — rather than by team keeps each table small, keeps its purpose legible, and makes a change reviewable, because the reviewer can see which subnets are affected by reading one association list. ## What routing does not decide - **It does not decide permission.** An entry creates a path. Whether a packet is allowed along that path is a separate filtering decision, and whether the caller may use the service is a third, at the application. - **It does not decide the source address.** That is a property of the target: a translating gateway rewrites it, a direct attachment does not. - **It does not fix itself.** Routing is stated, not discovered: nothing in the platform notices that a subnet is unreachable and adds the missing entry. The answer an interviewer is listening for is two sentences: association picks the table, longest match picks the entry — and then the discipline of checking the effective association before reading any entries.