How to Configure Router Discovery and Advertising in Windows 11 Using PowerShell

In modern enterprise networks and lab environments running IPv4 and IPv6, client devices determine default gateway routers and route metrics using dynamic router discovery mechanisms. Under IPv6, standard router discovery operates via ICMPv6 Router Solicitation and Router Advertisement (RA) messages. Under IPv4, RFC 1256 defines the ICMP Router Discovery Protocol (IRDP). Additionally, when Windows 11 systems act as multihomed gateways, mobile hotspots, or Hyper-V virtual router hosts, an interface can actively broadcast router advertisements to downstream guest virtual machines and connected hosts.

Managing whether a Windows 11 interface listens for incoming router advertisements or actively advertises default route prefixes is critical for network security. Malicious or misconfigured rogue routers can send unsolicited router advertisements, hijacking default gateways or injecting spoofed DNS parameters. Using PowerShell and the NetTCPIP module, network administrators can inspect, enable, or disable Router Discovery and Advertising states on specific network adapters. This tutorial explains how to configure Router Discovery and Router Advertisements in Windows 11 using PowerShell.

Understanding Router Discovery and Advertising in Windows 11

The native Windows IP interface stack (Set-NetIPInterface) governs two complementary routing parameters:

• RouterDiscovery: Determines whether the Windows client actively listens for ICMP Router Advertisements sent by local gateway routers. When set to Enabled, Windows dynamically learns its default gateway and prefix lifetimes from received RA packets. When set to Disabled, Windows ignores router discovery broadcasts, relying exclusively on static routes or DHCP options.
• Advertising: Governs whether the local Windows interface broadcasts Router Advertisements into the subnet. In standard client scenarios, this is set to Disabled. When configuring Windows 11 as a software router, Internet Connection Sharing (ICS) host, or Hyper-V NAT bridge, setting this to Enabled broadcasts prefix announcements to connected peers.

Step 1: Open PowerShell with Administrative Privileges

Modifying kernel-level network interface parameters requires elevated administrator rights:

1. Right-click the Windows Start menu icon or press Win + X.
2. Select Terminal (Admin) or PowerShell (Admin).
3. Select Yes when prompted by the User Account Control (UAC) dialogue.

Step 2: Inspect Current Router Discovery and Advertising States

Query your active network adapters to review current interface indexes, discovery status, and advertising configurations:

Get-NetIPInterface | Select-Object InterfaceAlias, InterfaceIndex, AddressFamily, RouterDiscovery, Advertising, ConnectionState | Format-Table -AutoSize

Notice the distinction between IPv4 and IPv6 families. By default on Windows 11:

• IPv6 interfaces frequently configure RouterDiscovery as Enabled (as required by SLAAC – Stateless Address Autoconfiguration).
• Advertising is set to Disabled across all standard client adapters.

Step 3: Enable or Disable Router Discovery on Specific Adapters

If your device operates on a high-security network where rogue Router Advertisements present an attack vector, or if static IP configurations are mandatory, disable dynamic router discovery:

Disable Router Discovery on an Interface

# Disable IPv6 Router Discovery on a specific adapter by InterfaceIndex
Set-NetIPInterface -InterfaceIndex 12 -AddressFamily IPv6 -RouterDiscovery Disabled

# Or target the interface using its InterfaceAlias
Set-NetIPInterface -InterfaceAlias "Wi-Fi" -AddressFamily IPv6 -RouterDiscovery Disabled

Re-Enable Router Discovery for Dynamic SLAAC

To restore standard automatic gateway and prefix acquisition via Router Advertisements:

Set-NetIPInterface -InterfaceAlias "Wi-Fi" -AddressFamily IPv6 -RouterDiscovery Enabled

You can also control IPv4 router discovery (IRDP) using the same cmdlet with -AddressFamily IPv4.

Step 4: Configure Router Advertisements (Advertising Mode)

When using Windows 11 to route traffic between physical network adapters and Hyper-V virtual switches, you can configure the internal interface to broadcast router advertisements:

Enable Router Advertisements on an Internal Network Interface

# Enable router advertising for IPv6 on the internal virtual switch
Set-NetIPInterface -InterfaceAlias "vEthernet (InternalSwitch)" -AddressFamily IPv6 -Advertising Enabled

When Advertising is enabled, Windows periodically transmits RA packets containing local prefix information to all nodes on the link-local network.

Disable Router Advertisements

To prevent Windows from sending router advertisements and restore standard host mode:

Set-NetIPInterface -InterfaceAlias "vEthernet (InternalSwitch)" -AddressFamily IPv6 -Advertising Disabled

Step 5: Verify Route Injection and Interface Health

After adjusting Router Discovery or Advertising policies, verify that the routing table reflects your intended gateway topology:

# View active default routes and gateways
Get-NetRoute -DestinationPrefix "::/0" | Select-Object DestinationPrefix, NextHop, InterfaceAlias, RouteMetric

# Inspect detailed interface flags
Get-NetIPInterface -InterfaceAlias "Wi-Fi" -AddressFamily IPv6 | Format-List

Security Considerations and Best Practices

• Mitigating Rogue RA Attacks: On unmanaged public Wi-Fi networks, malicious actors can broadcast fraudulent IPv6 Router Advertisements, redirecting internet traffic through a man-in-the-middle proxy. Disabling RouterDiscovery on untrusted networks or relying on Windows Defender Firewall rules prevents unauthorised gateway overrides.
• Virtual Machine Isolation: When testing virtual routers inside Hyper-V on Windows 11, ensure Advertising is kept Disabled on the external physical network adapter to prevent accidental broadcast of internal routing prefixes into corporate LANs.
• SLAAC Dependency: Completely disabling IPv6 RouterDiscovery on networks without DHCPv6 servers prevents Windows from obtaining a global IPv6 address. Ensure static IP assignments or local DHCP servers are active before disabling discovery.