Why is traffic not going through the default gateway?

Question

linux

The network has 2 gateways on linux, everyone can forward without restrictions.
Network 10.128.0.0/24

Gateway First - 10.128.0.1/24 (should not be used)
Gateway Second - 10.128.0.4/24 (should be default gateway)

Machine on network 10.128.0.7/24 is set to default gateway - 10.128.0.4/ 24 , I can’t understand why it still climbs through 10.128.0.1, where and where to dig? What a miracle, I am attaching below the machine settings.

ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether d0:0d:18:ff:79:2e brd ff:ff:ff:ff:ff:ff
    altname enp138s0
    altname ens8
    inet 10.128.0.7/24 brd 10.128.0.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::d20d:18ff:feff:792e/64 scope link
       valid_lft forever preferred_lft forever

ip route

default via 10.128.0.4 dev eth0 onlink
10.128.0.0/24 dev eth0 proto kernel scope link src 10.128.0.7

cat /etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet static
    address 10.128.0.7
    netmask 255.255.255.0
    gateway 10.128.0.4
    dns-nameservers 8.8.8.8

Well, actually ...
traceroute 8.8.8.8

traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  10.128.0.1 (10.128.0.1)  0.507 ms  1.121 ms  1.111 ms

Why does it refer to 10.128.0.1 if default gw is 10.128.0.4 ?

YANDEX CLOUD platform.
All machines are on the same network.
Is it worth contacting Yandex TP?
It is very interesting how this can be, and what is worth checking?

Answer 1

In traceroute, you see the router's response about the path of the packet. Your first hop probably has both 10.128.0.1 and 10.128.0.4, but it sends an ICMP Time-to-Live Exceeded packet from 10.128.0.1. This does not mean that traffic is routed through the address 10.128.0.1.