Here’s a network diagram:
I have an isolated sandbox network, and connected to it is a jump server that’s got 2 NICs in it. One NIC in the jump server is connected to the isolated sandbox network (“Fake192”), the other NIC is connected to a general use network (“Gen16”) that’s reachable from the rest of my company network and also has internet access. The jump server is NOT configured to be a router. It has a default gateway of 10.0.16.1 (actually serviced by 10.0.16.2 because HSRP) configured on the “Gen16” connected NIC, and no default gateway configured on the “Fake192” NIC.
The cloned servers on the “Fake192” network are configured to have a default gateway of 192.168.2.1, but I have purposefully NOT attached a router with that address on the “Fake192” network. If either of the cloned servers want to talk to anything not on the directly connected network, they’re out of luck, by design.
Additionally, there is a Real Production Network ™ that is also configured as 192.168.2.0/23 (“Real192”). Servers on that network have a default gateway of 192.168.2.1 (which is a router that exists) and are reachable from the rest of the company network, and they can see the internet.
Since the jump server has 2 directly connected networks and one default gateway, I would expect it to send traffic destined for 192.168.2.0/23 out of the 192.168.2.10 interface, and any other traffic out the 10.0.16.101 interface.
If I’m sitting on the jump server and I try to connect to hosts in the sandbox network, the jump server will send traffic out the 192.168.2.10 NIC to “Server D1 Clone” and “Server D2 Clone” on “Fake192”, which is as expected.
If I try to connect to 192.168.2.12 from the jump server, I would EXPECT it to fail, as there is not a clone of Server P on the “Fake192” sandbox network.
The behavior that I OBESERVE is that the sandbox will connect to the REAL Server P on “Real192”. EVEN THOUGH the jump server has a directly connected 192.168.2.0/23 network, it will send traffic destined for 192.168.2.12 to the default gateway on the “Gen16” network, and that router will then dutifully route it to “Real192”
Here’s the routing table from the jump server:
And here are a couple traceroutes from the jump server:
So… what the heck is happening here? Why is Windows insisting on sending traffic for a directly connected network to a default gateway?