From netstat(1) man page:

LetterFlagMeaning
1RTF_PROTO1Protocol specific routing flag #1
2RTF_PROTO2Protocol specific routing flag #2
3RTF_PROTO3Protocol specific routing flag #3
BRTF_BLACKHOLEJust discard packets (during updates)
bRTF_BROADCASTThe route represents a broadcast address
CRTF_CLONINGGenerate new routes on use
cRTF_PRCLONINGProtocol-specified generate new routes on use
DRTF_DYNAMICCreated dynamically (by redirect)
GRTF_GATEWAYDestination requires forwarding by intermediary
HRTF_HOSTHost entry (net otherwise)
IRTF_IFSCOPERoute is associated with an interface scope
iRTF_IFREFRoute is holding a reference to the interface
LRTF_LLINFOValid protocol to link address translation
MRTF_MODIFIEDModified dynamically (by redirect)
mRTF_MULTICASTThe route represents a multicast address
RRTF_REJECTHost or net unreachable
rRTF_ROUTERHost is a default router
SRTF_STATICManually added
URTF_UPRoute usable
WRTF_WASCLONEDRoute was generated as a result of cloning
XRTF_XRESOLVEExternal daemon translates proto to link address
YRTF_PROXYProxying; cloned routes will not be scoped

To find current gateway when using a VPN:

 netstat -rna -f inet | grep UGHS | awk '{print $1}'