No Route to Host Error in Linux: What to Do

If you see “No route to host” in Linux, it means your computer cannot find a network path to the destination IP address or hostname. The fix usually involves checking your network configuration, firewall rules, and the target machine’s availability. This article explains the common causes and provides step-by-step troubleshooting commands.

What Does “No Route to Host” Mean?

This error is generated by the Linux kernel’s network stack when it tries to send a packet to a destination but cannot determine a valid route. It is different from “Connection timed out,” which means the packet was sent but no reply came back. “No route to host” typically indicates a local routing problem, a missing default gateway, or an intermediary device (like a router or firewall) sending back an ICMP “Destination Unreachable” message with code 1 (Host Unreachable).

Common Causes

Incorrect IP address or hostname – you may be trying to reach a machine that doesn’t exist on your network.
Missing or wrong default gateway – the route table doesn’t have a path to the destination network.
Firewall on the destination or an intermediate device – a firewall may be dropping packets and sending back an ICMP unreachable.
The destination host is down – the machine is powered off or not connected to the network.
VPN or network interface issues – a VPN tunnel may be down, or the interface has no IP address.

Step-by-Step Troubleshooting

Follow these steps in order. Stop when the error is resolved.

Verify the IP address and hostname. Use ping <hostname> or ping <IP>. If you get “Name or service not known,” check DNS with getent hosts <hostname>.
Check your routing table. Run ip route show. Look for a default route (e.g., default via 192.168.1.1 dev eth0). If missing, add one with sudo ip route add default via <gateway-IP> dev <interface>.
Test connectivity to the gateway. Ping your gateway IP. If that fails, your interface may be down or misconfigured.
Check the interface status. Run ip addr show. Ensure the interface has an IP address and is UP. If not, bring it up with sudo ip link set <interface> up and obtain an address via DHCP (sudo dhclient <interface>) or set a static one.
Inspect firewall rules on your own machine. Use sudo iptables -L or sudo nft list ruleset (for nftables). Look for OUTPUT or FORWARD rules that might drop packets. Temporarily disable the firewall to test: sudo ufw disable (if using UFW).
Check the destination host. From another machine on the same network, try to reach the destination. If it’s unreachable from everywhere, the host is down or its firewall is blocking.
Use traceroute to find where the path breaks. Run traceroute -n <IP>. The last hop that replies is where the problem lies. If you see * * * after a certain hop, that router is not responding (possibly filtering ICMP).
Check for VPN or multiple interfaces. If you have a VPN, ensure it’s connected. Sometimes a VPN route overrides the default route, causing “No route to host” for local addresses. Try disconnecting the VPN and re-testing.

How to Read the Route Table

The command ip route show displays the kernel’s routing table. Each line shows a destination network, the gateway (if any), the interface, and optionally metrics. For example:

default via 192.168.1.1 dev eth0 proto dhcp metric 100
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100

The first line is the default route – used when no more specific route matches. The second line is a connected route for your local subnet. If the destination IP is not in any of the listed networks, the kernel uses the default route. If no default route exists, you get “No route to host.”

Firewall and ICMP Considerations

Firewalls can generate the error by sending an ICMP “Destination Unreachable” (type 3, code 1). This often happens when a host is up but the firewall drops the packet and replies with that ICMP message. To test if a firewall is the culprit, you can try a different protocol, like SSH (ssh user@host) or HTTP (curl -v http://host). If those time out instead of giving “No route to host,” the firewall may be silently dropping packets. On the destination, you can temporarily allow ICMP echo requests (for ping) and check logs (e.g., dmesg or journalctl) for dropped packets.

Common Mistakes and Misconceptions

Confusing “No route to host” with “Connection refused.” The latter means the host is reachable but no service is listening on that port.
Assuming the error is always on your machine. An intermediate router can send the ICMP unreachable, so the problem may be elsewhere in the network path.
Not checking the destination’s firewall. Even if your own firewall is off, the destination may be blocking you.
Overlooking IPv6. If you are using IPv6, check ip -6 route show and ensure you have a global IPv6 address. Sometimes the error is due to missing IPv6 default route.

When the Problem Persists

If you’ve gone through all steps and still get the error, consider these advanced checks:

Check ARP cache. Run ip neigh show. If the entry for your gateway shows FAILED or INCOMPLETE, the gateway is not responding to ARP requests.
Review network manager logs. If using NetworkManager, check journalctl -u NetworkManager for errors.
Test with a static route. Add a temporary static route to the destination network: sudo ip route add <network>/<prefix> via <gateway> and test again.
Check SELinux or AppArmor. On some distributions, these security modules can block network operations. Look for denials in dmesg or ausearch -m avc.

Frequently Asked Questions

What is the difference between “No route to host” and “Connection timed out”?

“No route to host” means the network stack cannot find a path to the destination, either because there is no route or an intermediate device sent an ICMP unreachable. “Connection timed out” means packets are being sent but no reply is received, usually due to a firewall dropping packets or the host being down without a router sending an unreachable message.

Can a firewall on my own machine cause this error?

Yes, if your firewall has an OUTPUT rule that drops packets to certain destinations, the kernel may generate “No route to host” (though it often just drops silently). Check your iptables/nftables rules and try disabling the firewall temporarily to test.

How do I fix “No route to host” when pinging a local IP?

If the IP is on your local subnet, ensure your interface has an IP in that subnet and is up. Check ip addr show and ip route show. If the route is missing, add it with sudo ip route add <local-network>/<prefix> dev <interface>.

Why does “No route to host” appear when using SSH but not ping?

This could be because the destination firewall allows ICMP but blocks TCP port 22, or because your SSH client is trying to connect to an IPv6 address that has no route, while ping uses IPv4. Try using the IP address directly with ssh -4 user@IP to force IPv4.

Is “No route to host” always a network configuration issue?

Not always. It can be caused by the destination being down, a firewall on an intermediate router sending an ICMP unreachable, or even a misconfigured VPN. Always check the route table first, then work your way through the path.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →