Windows static routes w/o specifying gateway (next hop)

This may not be possible with windows

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/route.mspx

Quote: For locally attached subnet routes, the gateway address is the IP address assigned to the interface that is attached to the subnet.

In windows you can add a route based on the interface without knowing the gateway by passing 0.0.0.0 as gateway

this gives something like this:

route add <IPtoRoute> mask <MaskOfTheIp> 0.0.0.0 IF <InterfaceNumber>

route add 203.0.113.9 mask 255.255.255.255 0.0.0.0 IF 2

I got the same in Windows 7 Enterprise with the Juniper Junos Pulse VPN client.
I had a problem with this, as it captured all possible IPv4 addresses and routed these to the dial-up connection:

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          1.0.0.0        255.0.0.0         On-link       XX.XX.XX.XX     11
          2.0.0.0        254.0.0.0         On-link       XX.XX.XX.XX     11
          4.0.0.0        252.0.0.0         On-link       XX.XX.XX.XX     11
          8.0.0.0        248.0.0.0         On-link       XX.XX.XX.XX     11
         16.0.0.0        240.0.0.0         On-link       XX.XX.XX.XX     11
         32.0.0.0        224.0.0.0         On-link       XX.XX.XX.XX     11
         64.0.0.0        192.0.0.0         On-link       XX.XX.XX.XX     11
        128.0.0.0        128.0.0.0         On-link       XX.XX.XX.XX     11

I did not want all my traffic to pass through the VPN, so in case anybody needs it, I wrote a small cmd file to remove these routes and then install the only one I need (10.0.0.0) without being able to specify a gateway, by specifying the right interface.
You can use this to dynamically retrieve an interface's number.

@rem Get the interface number
set IF=
for /f "tokens=1,8 delims=. " %%A in ('route print') do @if /i "%%B" equ "Juniper" set IF=%%A
@rem If interface is not found, terminate quietly
if not defined IF exit /b
for %%A in (1 2 4 8 16 32 64 128) do @route delete %%A.0.0.0
route add 10.0.0.0 mask 255.0.0.0 0.0.0.0 IF %IF%

The Interface number in decimal is displayed with route print. Look at the top of the output under Interface List.

Another way is to use arp -a and make note of the hexadecimal number, eg:

C:\>arp -a

Interface: 192.168.1.28 --- 0xc  
  Internet Address      Physical Address      Type
<snip>

Both are accepted after the if argument in route.exe, eg:

route ADD <NET-ID> MASK <mask> <GW-address or 0.0.0.0 for on-link> IF 0xc -P

I prefer arp -a, as it is easier to identify the NIC.

Numerous other ways, but this is the simplest.