Simple definition
A blackhole route is a route that intentionally discards packets for a given prefix instead of forwarding them.
Technical definition
It installs a destination in the routing table with a silent discard action or unusable next hop. It can prevent traffic intended for a private or VPN network from accidentally falling back to a default route when the expected path disappears.
How it works / role
The router compares the packet destination with its routing table. If the blackhole route is the best active match, the packet is dropped locally. Its administrative distance, metric, and especially prefix length determine when it takes precedence over other routes.
What is it used for?
Prevent routing leaks, secure some VPN scenarios, absorb unwanted prefixes, or stabilize routing-table behavior.
Practical example
A FortiGate keeps a blackhole route for a remote VPN network; if the tunnel goes down, that traffic is discarded instead of being sent to the Internet through the default route.
Common issues
- The prefix is too broad and blocks legitimate traffic
- Distance or priority is wrong relative to the expected dynamic route
- The blackhole route is more specific than intended
- Troubleshooting becomes confusing when the primary tunnel or route disappears
Related terms
Key takeaway: A blackhole route should be intentional, narrowly scoped, and verified against the effective routing table.