What is 1.1.1.1? Why does it work for traceoute but not ping?

1.1.1.1 is contained in APNIC-LABS (1.1.1.0/24), a research network of APNIC Labs. It is reachable (with ping and the like) only when a test is performed. That doesn’t mean, however, that there’s no route to it. It’s a regular IP address, after all.

Traceroute is very different from ping. Only in the last step will it actually contact the destination (1.1.1.1 in your case).

Traceroute, by default, sends a sequence of User Datagram Protocol (UDP) packets addressed to a destination host; ICMP Echo Request or TCP SYN packets can also be used. The time-to-live (TTL) value, also known as hop limit, is used in determining the intermediate routers being traversed towards the destination. Routers decrement TTL values of packets by one when routing and discard packets whose TTL value has reached zero, returning the ICMP error message ICMP Time Exceeded.

I don’t exactly understand your default gateway trouble, though. Any IP traffic leaving a host is directed at the next hop as indicated by the routing table. If there’s a fallback entry, the so-called default gateway, traffic not matching any other rule is directed there.

@bertieb Raises a good point, though: Some ISP-side data compression proxies also use this address illegally.

What is 1.1.1.1?

1.1.1.1 is a public, assigned IP address; which is why you can traceroute to it. It was assigned to APNIC in 2010 (with the rest of the 1.0.0.0/8 block), and pretty useless as many folks treat it as a placeholder.

See Shane Madden's answer over at Server Fault for more info, including the article about traffic linked there.

1.1.1.1 is used as the default address of the DHCP server on CISCO routers.

However, on the public internet, 1.1.1.1 now belongs to Cloudflare DNS service.

Whois record:

inetnum:        1.1.1.0 - 1.1.1.255
netname:        APNIC-LABS
descr:          APNIC and Cloudflare DNS Resolver project
descr:          Routed globally by AS13335/Cloudflare
descr:          Research prefix for APNIC Labs
country:        AU
org:            ORG-ARAD1-AP
admin-c:        AR302-AP
tech-c:         AR302-AP
mnt-by:         APNIC-HM
mnt-routes:     MAINT-AU-APNIC-GM85-AP
mnt-irt:        IRT-APNICRANDNET-AU
status:         ASSIGNED PORTABLE
remarks:        ---------------
remarks:        All Cloudflare abuse reporting can be done via
remarks:        [email protected]
remarks:        ---------------
last-modified:  2018-03-30T01:51:28Z
source:         APNIC