SELECT
    ia.address,
    id.mac
FROM
    interface_addresses ia
    JOIN interface_details id ON id.interface = ia.interface
    JOIN routes r ON r.interface = ia.address
WHERE
    (r.destination = '0.0.0.0' OR r.destination = '::') AND r.netmask = 0
    AND r.type = 'remote'
    AND (
    inet_aton(ia.address) IS NOT NULL AND (
      split(ia.address, '.', 0) = '10'
      OR (split(ia.address, '.', 0) = '172' AND (CAST(split(ia.address, '.', 1) AS INTEGER) & 0xf0) = 16)
      OR (split(ia.address, '.', 0) = '192' AND split(ia.address, '.', 1) = '168')
    )
    OR (inet_aton(ia.address) IS NULL AND regex_match(lower(ia.address), '^f[cd][0-9a-f][0-9a-f]:[0-9a-f:]+', 0) IS NOT NULL)
  )
ORDER BY
    r.metric ASC,
  inet_aton(ia.address) IS NOT NULL DESC
LIMIT 1;

$defaultRoutes = Get-NetRoute | Where-Object {
    ($_.DestinationPrefix -eq '0.0.0.0/0' -or $_.DestinationPrefix -eq '::/0') -and
    ($_.NextHop -ne '0.0.0.0' -and $_.NextHop -ne '::')
}

function Test-PrivateIPv4 {
    param ([string]$ip)
    $parts = $ip.Split('.')
    if ($parts.Count -ne 4) { return $false }
    if ($parts[0] -eq '10') { return $true }
    if ($parts[0] -eq '172') {
        # Convert second octet to integer and perform bitwise AND with 240. 
        $octet2 = 0
        if ([int]::TryParse($parts[1], [ref]$octet2)) {
            if ( ($octet2 -band 240) -eq 16 ) { return $true }
        }
    }
    if (($parts[0] -eq '192') -and ($parts[1] -eq '168')) { return $true }
    return $false
}

function Test-PrivateIPv6 {
    param ([string]$ip)
    # Match IPv6 ULA: fc00::/7, but osquery regex enforces fc or fd then two hex digits then colon.
    if ($ip.ToLower() -match '^f[cd][0-9a-f]{2}:[0-9a-f:]+') { return $true }
    return $false
}

$results = @()

foreach ($route in $defaultRoutes) {
    # Get the adapter for current route by InterfaceIndex
    $adapter = Get-NetAdapter -InterfaceIndex $route.InterfaceIndex -ErrorAction SilentlyContinue
    if (-not $adapter) { continue }
    # Get all IP addresses for this interface
    $ips = Get-NetIPAddress -InterfaceIndex $route.InterfaceIndex -ErrorAction SilentlyContinue
    if (-not $ips) { continue }
    foreach ($ipObj in $ips) {
        $address = $ipObj.IPAddress
        $isIPv4 = $address.Contains('.')
        $isValid = $false
        if ($isIPv4) {
            $isValid = Test-PrivateIPv4 -ip $address
        }
        else {
            $isValid = Test-PrivateIPv6 -ip $address
        }
        if (-not $isValid) { continue }
        $results += [PSCustomObject]@{
            Address     = $address
            MAC         = $adapter.MacAddress
            RouteMetric = $route.RouteMetric
            IsIPv4      = $isIPv4
        }
    }
}

if ($results.Count -gt 0) {
    # Order by route metric ascending, then prioritize IPv4 addresses over IPv6
    $selected = $results | Sort-Object RouteMetric, @{Expression = {$_.IsIPv4 -eq $true} ; Descending = $true} | Select-Object -First 1
    Write-Output ("Address: {0}" -f $selected.Address)
    Write-Output ("MAC: {0}" -f $selected.MAC)
} else {
    Write-Output "No matching interface found."
}

PowerShell commands are currently work in progress, contributions welcome.

Bash commands are currently work in progress, contributions welcome.