A destination-specific route can fix access to an internal subnet while leaving Internet and management traffic on the existing default gateway. This Rocky Linux example sends only 172.16.50.0/24 through an internal router. Inspect both the saved NetworkManager profile and the effective route after each change.
The explanation is based on the NetworkManager environment of Rocky Linux 9. First test the route with ip route, then save it to the connection profile as nmcli. Change the NIC name, connection profile, and IP address to match the actual server.
On this page
Example destination and next hop
| item | example value |
|---|---|
| Management network NIC | ens18 · 192.168.10.50/24 |
| default gateway | 192.168.10.1 |
| Internal network NIC | ens19 · 192.168.20.10/24 |
| internal network router | 192.168.20.1 |
| Destination band/server | 172.16.50.0/24 · 172.16.50.20 |
The next hop is the router that the packet will first pass through to get to its destination. The server’s 192.168.20.10/24 and the next hop 192.168.20.1 must be able to communicate on the same link. The router must have a route and policy that forwards to 172.16.50.0/24.
Static IP is a setting that fixes the server’s own address, and static routing is a setting that determines the delivery direction for each destination. Here we will use the addresses of both NICs already configured. If you need to set the address first, please refer to Rocky Linux static IP setup article .
1. Check the NIC and connection profile first.
cat /etc/rocky-release
nmcli --version
ip -br address
ip -4 route show
nmcli -f NAME,UUID,TYPE,DEVICE connection show --active
nmcli -g GENERAL.CONNECTION device show ens19ens19 is the interface name and may be different from the NetworkManager connection profile name. Below we assume that the active profile for that NIC is internal-lan. If the names are different, replace them with the values you have verified. If there are multiple names, target them with the UUID of the active profile.
PROFILE='internal-lan'
nmcli -f connection.id,connection.interface-name,ipv4.addresses,ipv4.gateway,ipv4.routes \
connection show "$PROFILE"
ip -4 route get 192.168.20.1
ip -4 route get 172.16.50.20
ip -4 route show defaultVerify that the next hop 192.168.20.1 is looked up as a direct route to ens19. If you are working with SSH, check the actual connection PC address as ip route get. If the destination to be added includes a connecting PC, the SSH response path may also change.
Profile files are stored in a separate directory as shown below. Because the backup may contain access information, use a location that only root can read. NetworkManager’s classification of profiles and device states can also be found in the Rocky Linux network document .
BACKUP_DIR="/root/nm-route-backup-$(date +%Y%m%d-%H%M%S)"
sudo install -d -m 700 "$BACKUP_DIR"
sudo cp -a /etc/NetworkManager/system-connections "$BACKUP_DIR/"2. Test temporary route with ip route
The command below adds a route to the current kernel’s routing table. Settings that will remain after reboot or network reconfiguration are saved in the next section. If the same route already exists, check the purpose and metrics of the existing item before adding it.
sudo ip route add 172.16.50.0/24 via 192.168.20.1 dev ens19 metric 100
ip -4 route get 172.16.50.20
ping -c 3 -W 1 172.16.50.20With this address configuration, the query results will have the following form: Read whether via is the internal router, dev is the internal network NIC, and src is the internal network address. Additional fields and output format may vary depending on the iproute2 version.
172.16.50.20 via 192.168.20.1 dev ens19 src 192.168.20.10ip route get shows the path chosen by the kernel. Since this is not a check that the actual packet has arrived at the other end, ping and allowed service connections are also checked separately. In an environment where ICMP is blocked, ping failure alone is not considered a routing error.
If the test path is correct, remove the temporary entry and add it to the permanent profile. This can reduce situations where manual routes and NetworkManager-managed routes overlap.
sudo ip route del 172.16.50.0/24 via 192.168.20.1 dev ens19 metric 1003. Add persistent path with nmcli
PROFILE='internal-lan'
sudo nmcli connection modify "$PROFILE" \
+ipv4.routes "172.16.50.0/24 192.168.20.1 100"
nmcli -f ipv4.routes connection show "$PROFILE"
sudo nmcli device reapply ens19The order of values is 목적지/접두사 다음홉 메트릭. The preceding + adds an entry to the existing route list. Just writing ipv4.routes replaces the existing list, so you can clear other paths that are already saved. The add/delete syntax was compared with RHEL 9 static route configuration document .
connection modify saves the profile, and device reapply attempts to apply the changes to the active connection. The actual routing table is also checked after the success message. At this time, the default gateway or NIC address are not changed together.
ip -4 route show 172.16.50.0/24
ip -4 route get 172.16.50.20
ip -4 route show default
ping -c 3 -W 1 172.16.50.20If reapply responds that the change is not supported or is not reflected, reactivate the profile as below during maintenance time when the console is available. Your connection may be briefly lost. For the roles of the two commands, refer to the nmcli device management document .
sudo nmcli connection up "$PROFILE" ifname ens19In environments where active profiles are managed to auto-connect, the saved routes will also be applied on the next activation. Reboot verification of the operating server is performed during maintenance time, and after rebooting, the same ip route get and actual service connection are checked again.
4. Example of application to one server or multiple bands
Send only one specific server to another router
sudo nmcli connection modify "$PROFILE" \
+ipv4.routes "172.16.50.20/32 192.168.20.1 100"
sudo nmcli device reapply ens19
ip -4 route get 172.16.50.20/32 is the route to one IPv4 address. In the same table, /32 takes precedence over /24 because more specific prefixes are chosen first. When comparing routes with the same destination/prefix, lower metrics take precedence, and policy routing rules can influence table selection before that.
Adding two bands with the same next hop
sudo nmcli connection modify "$PROFILE" +ipv4.routes \
"172.16.60.0/24 192.168.20.1 100, 172.16.70.0/24 192.168.20.1 100"
sudo nmcli device reapply ens19Select and use examples according to your needs. 172.16.50.0/24 in the previous section and the above two bands are different paths. Arbitrarily grouping them into one wider band can be rerouted to different destinations, thus maintaining actual allocation coverage.
5. When there is a route but communication is not possible
ip -4 route get 172.16.50.20
ip -4 route get 172.16.50.20 from 192.168.20.10
ping -c 3 -W 1 192.168.20.1
ip neigh show dev ens19
ip -4 rule show
ip -4 route show table all| symptoms | Next check |
|---|---|
| Gateway is invalid | ens19 Check whether the address/prefix and the gateway are the same link |
| Exit to default gateway | Destination typo, more specific path, check ip rule and other tables |
| Path is correct but no response | Check whether the next hop has been reached, the router’s forwarding/ACL, and the other party’s return path |
| Path disappears after reboot | ip route Check whether you have only temporary settings and whether permanent settings are loaded. |
Even if the request arrives at the destination, there will be no connection if the response has no path back to 192.168.20.10. Check the return route to 192.168.20.0/24 from the destination server’s gateway or its router. You can also check it with ip route get 192.168.20.10 on Linux on the other side.
The Rocky server in this article is a host that sends traffic that it creates. IP forwarding and forwarding firewall policies are additionally required only when used as a router that relays packets from other devices between two NICs. kernel IP forwarding document Differentiates the applicable target of and does not lower the entire server firewall to resolve path problems.
If the message is Nexthop has invalid gateway, check the NIC address, netmask, VLAN, and virtual switch connection. Just clearing the error display with onlink does not actually create a gateway on the same link. The property is defined in document NetworkManager IPv4 Settings document.
6. Deleting and restoring added paths
To clear a persistent entry, simply remove the path from the same profile. If you specify a metric to add it, the same value will be used when deleting it.
sudo nmcli connection modify "$PROFILE" \
-ipv4.routes "172.16.50.0/24 192.168.20.1 100"
sudo nmcli device reapply ens19
nmcli -f ipv4.routes connection show "$PROFILE"
ip -4 route show 172.16.50.0/24
ip -4 route get 172.16.50.20If you just delete the kernel path, it will appear again when you reactivate the profile. Conversely, if you only modify the profile and do not reflect it in the active status, the existing path may remain for a while. View saved profiles and running tables together.
If SSH is disconnected, remove the incorrectly added profile items from the virtualization console and reapply them. If you need to recover the profile itself, just return the profile file from the backup to its original location and activate the correct profile after sudo nmcli connection reload. Be sure to specify exactly what you added, as clearing the entire routing table may result in the management network’s default routes disappearing.
Example files and verification environment
Rocky Linux static routing example ZIP contains commands for adding and deleting profiles and read-only confirmation commands. Replace the example address with the actual value and use only the necessary parts. How to configure the same route in Ubuntu is summarized in the article Ubuntu Netplan Static Routing .
The original lab run on October 23, 2026 used NetworkManager 1.54.3-5.el9_8 in a Rocky Linux 9 container with isolated virtual links and network namespaces. It checked temporary-route communication; profile save, reapply and reactivation; removal of the target route while retaining other existing routes; and /32 routes. Removing the return route caused communication to fail, and restoring it recovered communication. Actual VM reboot and recovery from an interrupted SSH session were not tested.
