Windows route add: add, delete and keep routes (route, PowerShell, netsh)

Short answer: to add a route in Windows, open Command Prompt as Administrator and run route add 10.20.0.0 mask 255.255.0.0 192.168.1.1 (destination, subnet mask, gateway). Add -p to keep it after a reboot, and metric or if to set its cost and interface. route print lists the table, route delete 10.20.0.0 removes the route.

route print -4                                             # current IPv4 table
route add 10.20.0.0 mask 255.255.0.0 192.168.1.1 metric 10 if 12
route -p add 10.20.0.0 mask 255.255.0.0 192.168.1.1        # survives a reboot
route delete 10.20.0.0 mask 255.255.0.0

New-NetRoute -DestinationPrefix 10.20.0.0/16 -InterfaceIndex 12 -NextHop 192.168.1.1 -RouteMetric 10
Remove-NetRoute -DestinationPrefix 10.20.0.0/16 -Confirm:$false

Syntax and defaults on this page follow Microsoft Learn’s reference for the route command and the NetTCPIP PowerShell module, as of October 2026, and apply to current Windows 10, Windows 11 and Windows Server releases; the sample outputs are illustrative. If you run these on a remote server, read the RDP warning first.

route.exe and PowerShell side by side

Read the routing table: route print

route print prints three blocks: the Interface List with the index number of every adapter, the IPv4 Route Table and the IPv6 Route Table. route print -4 limits it to IPv4, and a pattern such as route print 10.* shows only matching destinations.

===========================================================================
Interface List
 12...00 15 5d 01 02 03 ......Microsoft Hyper-V Network Adapter
  1...........................Software Loopback Interface 1
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.50     25
      192.168.1.0    255.255.255.0         On-link      192.168.1.50    281
     192.168.1.50  255.255.255.255         On-link      192.168.1.50    281
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
===========================================================================
Persistent Routes:
  None

• 0.0.0.0 with mask 0.0.0.0 is the default route: where everything goes that no more specific route matches.
• On-link means the destination is on a directly connected network and needs no gateway.
• The Interface column shows the adapter’s own IP address, not its index. For if you need the number from the Interface List at the top (12 above), or Get-NetAdapter in PowerShell.
• Persistent Routes lists what was added with -p: the routes that come back after a reboot.

route add, parameter by parameter

route [/f] [/p] [<command> [<destination>] [mask <netmask>] [<gateway>] [metric <metric>]] [if <interface>]]

1. 1Find the interface and the gateway

   Run route print -4 or, in PowerShell, Get-NetIPConfiguration, which shows each adapter’s index, address and default gateway in one view. The gateway for your new route must sit in one of the networks listed there.

2. 2Add the route without -p first

   route add 10.20.0.0 mask 255.255.0.0 192.168.1.1 metric 10 if 12

   Windows answers OK! on success. A route without -p disappears at the next reboot, which is the cheapest undo there is.

3. 3Check which route is used

   Find-NetRoute -RemoteIPAddress 10.20.1.5 | Select-Object -Last 1
   tracert -d -h 4 10.20.1.5

   The first hop of tracert should be your gateway, 192.168.1.1 in this example.

4. 4Make it permanent once it works

   route delete 10.20.0.0 mask 255.255.0.0
   route -p add 10.20.0.0 mask 255.255.0.0 192.168.1.1 metric 10 if 12

Delete or change a route

route delete takes the destination and, where several routes share it, the mask and gateway as well. Learn documents wildcards for print and delete, so route delete 10.* removes every route whose destination starts with 10. Check first with route print 10.*. route change edits the gateway or metric of an existing route in place.

How Windows picks a route: prefix length, then metric

Windows first takes the most specific matching route: a /32 host route beats a /16, which beats the /0 default route, whatever their metrics. Only among routes of the same length does the metric decide, and the value that counts is the route metric plus the interface metric. Learn notes that automatic metrics are on by default and give faster interfaces lower values. That is why a route you added with metric 10 shows up in route print as 35 on an adapter whose interface metric is 25, and the automatic on-link routes as 281 (256 plus 25).

Get-NetIPInterface -AddressFamily IPv4 | Sort-Object InterfaceMetric |
  Format-Table ifIndex, InterfaceAlias, InterfaceMetric, AutomaticMetric

Set-NetIPInterface -InterfaceIndex 18 -InterfaceMetric 5     # prefer this adapter

The typical case is two default routes, one through the network card and one through a VPN adapter: the one with the lower combined metric carries all your traffic. Changing the interface metric, rather than deleting routes, is the clean way to choose.

PowerShell: New-NetRoute and friends

The NetTCPIP cmdlets take a prefix in CIDR notation instead of a mask, and they name the interface by -InterfaceIndex or -InterfaceAlias. According to the New-NetRoute reference, a new route goes to both the active and the persistent store by default, so unlike route add it survives a reboot unless you say otherwise. The default route metric is 256.

# temporary route, gone after a reboot
New-NetRoute -DestinationPrefix 10.20.0.0/16 -InterfaceAlias "Ethernet" -NextHop 192.168.1.1 -PolicyStore ActiveStore

# list routes for one prefix, including where they are stored
Get-NetRoute -DestinationPrefix 10.20.0.0/16 | Format-List DestinationPrefix, NextHop, RouteMetric, ifIndex, Store

# change and remove
Set-NetRoute -DestinationPrefix 10.20.0.0/16 -RouteMetric 20
Remove-NetRoute -DestinationPrefix 10.20.0.0/16 -Confirm:$false

netsh, for scripts that already use it

netsh interface ipv4 show route
netsh interface ipv4 add route 10.20.0.0/16 "Ethernet" 192.168.1.1 metric=10 store=active
netsh interface ipv4 delete route 10.20.0.0/16 "Ethernet" 192.168.1.1

store=active keeps the route until the next reboot; netsh’s own help lists persistent as the default. For new scripts, the PowerShell cmdlets are easier to read and to check.

IPv6 routes

IPv6 routes use a prefix instead of a mask, and the next hop is often the router’s link-local address (fe80::1), which is only valid together with an interface. PowerShell handles that most clearly:

Get-NetRoute -AddressFamily IPv6 -DestinationPrefix ::/0          # the IPv6 default route
New-NetRoute -DestinationPrefix 2001:db8:100::/48 -InterfaceIndex 12 -NextHop fe80::1
route print -6

The IPv6 default route is ::/0. Windows does not always configure IPv6 on its own on a server with static addressing; the IPv4 vs IPv6 comparison explains prefixes and gateways if you are setting it up from scratch.

Example: split-tunnel a VPN with one route

A common reason to add a route: a VPN should carry traffic for the office network only, while everything else uses the normal internet connection. For a VPN profile made with the Windows built-in client, switch off “use default gateway on remote network” and attach the route to the profile, so Windows adds it every time the VPN connects:

Set-VpnConnection -Name "Office" -SplitTunneling $true
Add-VpnConnectionRoute -ConnectionName "Office" -DestinationPrefix 10.20.0.0/16 -PassThru

With WireGuard or OpenVPN, the client sets the routes from its own configuration (AllowedIPs, route lines) and a manual route add is rarely needed. The reverse case, a full-tunnel VPN on a server you reach over Remote Desktop, needs one extra host route for your own IP so the RDP session survives: running a VPN on a Windows RDP server walks through it.

On a remote server: do not cut your own RDP session

On a Windows VPS your Remote Desktop connection depends on the very routing table you are editing. Deleting or replacing the default route, route -f, a wrong route change 0.0.0.0, or a VPN that takes over the default route all freeze the session, and the server stays unreachable until someone undoes the change. Two habits prevent a locked-out evening:

• Test without -p and arm a timed rollback. A non-persistent route is gone after a reboot, so schedule one before the risky command and cancel it once RDP still works.
• Keep a second way in. If your provider’s panel offers a console that shows the screen through the hypervisor, open it before you start; it does not depend on the server’s routing.

shutdown /r /t 600 /c "route test: rollback in 10 minutes"
route add 0.0.0.0 mask 0.0.0.0 192.168.1.254 metric 5

rem still connected after the change? cancel the reboot:
shutdown /a

If a reboot would interrupt something important, schedule a task that deletes the new route instead: the same Register-ScheduledTask pattern as the VPN guide’s failsafe, with route.exe delete ... as the action. If the session drops anyway, wait for the rollback and reconnect; the guide to connecting to RDP covers the client side if it still will not connect.

Common route add errors

Routes on a Windows VPS

A VMHeaven Windows VPS comes with its own public IPv4 address and the default route already set, so a single-server setup needs no extra routes at all. Extra routes come in when you connect the server to something else: an office network over a VPN, a WireGuard tunnel to other servers, or a host route that keeps your RDP session outside a full tunnel. Add them without -p first, with a rollback armed, and make them permanent once they have survived a test.

Frequently asked