Documentation
VyOS Documentation
High Availability in VyOS

High Availability in VyOS

VRRP (Virtual Router Redundancy Protocol) provides automatic router redundancy for uninterrupted network operation.

Overview

VRRP (RFC 3768, RFC 5798) is a protocol for creating a virtual router from multiple physical devices.

How it works:

  • Several routers are combined into a VRRP group
  • One router becomes the Master (active)
  • The remaining routers are Backup (standby)
  • If the Master fails, a Backup automatically becomes the Master
  • Clients use a virtual IP address (which does not change during failover)

Use cases:

  • Default gateway redundancy for clients
  • High Availability for critical services
  • Eliminating a Single Point of Failure
  • Continuity during maintenance
  • Enterprise network redundancy

Advantages:

  • Automatic failover (without administrator intervention)
  • Transparency for clients (a single IP address)
  • Fast switchover (seconds)
  • Support for multiple VRRP groups
  • Standard protocol (RFC)

VRRP Concepts

Virtual Router ID (VRID)

A unique identifier for the VRRP group (1-255).

Important: The VRID must be unique within an L2 segment (broadcast domain).

Priority

The router priority used to elect the Master (1-255).

  • Higher priority = greater chance of becoming Master
  • Default: 100
  • A router with priority 255 is always the Master (owner)

Preemption

Automatic reclaiming of the Master role when a router with higher priority recovers.

  • Enabled by default - a router with higher priority takes over the Master role
  • Disabled (no-preempt) - the current Master remains active

Virtual IP Address

The IP address used by clients as their default gateway.

  • A group can have multiple virtual addresses
  • The Master answers ARP requests for the virtual IP
  • The Backup does not use the virtual IP

MAC Address

VRRP uses a special virtual MAC address:

  • IPv4: 00:00:5e:00:01:XX (XX = VRID)
  • IPv6: 00:00:5e:00:02:XX

Basic Configuration

Simple VRRP Group

Router 1 (Master - priority 200):

set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200

commit
save

Router 2 (Backup - priority 100):

set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 100

commit
save

Verification:

run show vrrp

Clients use 192.168.1.1 as their default gateway.

Multiple Virtual IPs

set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN address 192.168.1.254/24
set high-availability vrrp group LAN priority 200

commit

Both addresses will be active on the Master.

Priority and Preemption

Setting Priority

set high-availability vrrp group LAN priority 200
commit

Values:

  • 1-254 - regular routers
  • 255 - owner (the physical IP matches the virtual IP)

Disabling Preemption

set high-availability vrrp group LAN no-preempt
commit

A router with higher priority will not reclaim the Master role automatically.

Use case: Preventing frequent switchovers (flapping).

Preemption Delay

The delay before reclaiming the Master role:

set high-availability vrrp group LAN preempt-delay 180
commit

The router waits 180 seconds after boot before becoming Master.

Use case: Allowing time for services to stabilize.

Authentication

Protecting VRRP against unauthorized routers.

Plaintext Authentication

Not recommended (password stored in plaintext):

set high-availability vrrp group LAN authentication type plaintext-password
set high-availability vrrp group LAN authentication password 'MyPassword'
commit

AH Authentication

Recommended - uses IPsec AH:

set high-availability vrrp group LAN authentication type ah
set high-availability vrrp group LAN authentication password 'SecurePassword123!'
commit

The password must match on all routers in the group.

Health Check

Monitoring the router’s state and automatically lowering priority when problems occur.

Track Interface

Monitoring the state of an interface:

set high-availability vrrp group LAN track interface eth0
set high-availability vrrp group LAN track interface eth0 weight -50

commit

When eth0 goes down, priority is reduced by 50.

If priority drops below that of the Backup, a failover occurs.

Health Check Script

A custom script for checking availability:

set high-availability vrrp group LAN health-check script '/config/scripts/check-connectivity.sh'
set high-availability vrrp group LAN health-check interval 10
set high-availability vrrp group LAN health-check failure-count 3

commit

Script /config/scripts/check-connectivity.sh:

#!/bin/bash
# Check ISP connectivity
ping -c 1 -W 2 8.8.8.8 > /dev/null 2>&1
exit $?

Parameters:

  • interval - check interval (seconds)
  • failure-count - number of failures before failover
  • Exit code 0 - success, non-zero - error

Do not forget to make the script executable:

chmod +x /config/scripts/check-connectivity.sh

Transition Scripts

Running actions when the VRRP state changes.

Master Transition Script

Runs when transitioning to the Master state:

set high-availability vrrp group LAN transition-script master '/config/scripts/become-master.sh'
commit

Example /config/scripts/become-master.sh:

#!/bin/bash
logger "VRRP: Became Master"
# Start additional services
# systemctl start my-service

Backup Transition Script

Runs when transitioning to the Backup state:

set high-availability vrrp group LAN transition-script backup '/config/scripts/become-backup.sh'
commit

Fault Transition Script

Runs when transitioning to the Fault state:

set high-availability vrrp group LAN transition-script fault '/config/scripts/become-fault.sh'
commit

Stop Transition Script

Runs when VRRP is stopped:

set high-availability vrrp group LAN transition-script stop '/config/scripts/vrrp-stop.sh'
commit

Sync Groups

Synchronizing the state of multiple VRRP groups.

Creating a Sync Group

set high-availability vrrp sync-group SYNC-GROUP member LAN-INSIDE
set high-availability vrrp sync-group SYNC-GROUP member LAN-DMZ

commit

Effect: When one group transitions to Backup, all groups in the sync-group transition as well.

Use case: Coordinating failover across multiple networks.

Sync Group Transition Scripts

set high-availability vrrp sync-group SYNC-GROUP transition-script master '/config/scripts/sync-master.sh'
set high-availability vrrp sync-group SYNC-GROUP transition-script backup '/config/scripts/sync-backup.sh'

commit

Unicast VRRP

VRRP over unicast instead of multicast.

Use case: When multicast is not supported (some cloud providers).

set high-availability vrrp group LAN peer-address 10.0.0.2
set high-availability vrrp group LAN peer-address 10.0.0.3

commit

VRRP messages are sent directly to the specified peers (unicast).

Global Parameters

VRRP Version

set high-availability vrrp global-parameters version 3
commit

Versions:

  • 2 - RFC 3768 (default, IPv4)
  • 3 - RFC 5798 (IPv4 and IPv6)

Startup Delay

The delay before starting VRRP after boot:

set high-availability vrrp global-parameters startup-delay 60
commit

Allows time for the network to initialize before VRRP.

Gratuitous ARP

Parameters for ARP announcement:

set high-availability vrrp global-parameters garp interval 5
set high-availability vrrp global-parameters garp master-refresh 60

commit
  • interval - interval between GARPs (seconds)
  • master-refresh - GARP refresh interval from the Master

Conntrack Sync

Synchronizing connection tracking between routers for stateful failover.

Basic Configuration

set service conntrack-sync accept-protocol 'tcp'
set service conntrack-sync accept-protocol 'udp'
set service conntrack-sync accept-protocol 'icmp'

set service conntrack-sync failover-mechanism vrrp sync-group SYNC-GROUP

set service conntrack-sync interface eth2
set service conntrack-sync mcast-group 225.0.0.50

commit

Parameters

Accept Protocol - which protocols to synchronize:

set service conntrack-sync accept-protocol tcp
set service conntrack-sync accept-protocol udp

Ignore Address - do not synchronize connections from/to addresses:

set service conntrack-sync ignore-address ipv4 192.168.1.0/24

Interface - interface for sync traffic (a dedicated one is recommended):

set service conntrack-sync interface eth2

Multicast Group:

set service conntrack-sync mcast-group 225.0.0.50

Configuration Examples

Simple HA Gateway

Topology:

ISP --- [Router1] ---+
                     |--- 192.168.1.0/24 (LAN)
ISP --- [Router2] ---+

Router 1 (Master):

# WAN Interface
set interfaces ethernet eth0 address 203.0.113.10/24

# LAN Interface
set interfaces ethernet eth1 address 192.168.1.2/24

# VRRP
set high-availability vrrp group WAN vrid 10
set high-availability vrrp group WAN interface eth0
set high-availability vrrp group WAN address 203.0.113.1/24
set high-availability vrrp group WAN priority 200

set high-availability vrrp group LAN vrid 20
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200

# Sync Groups
set high-availability vrrp sync-group FAILOVER member WAN
set high-availability vrrp sync-group FAILOVER member LAN

# NAT
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

# Firewall
set firewall ipv4 input filter default-action drop
set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 state established
set firewall ipv4 input filter rule 10 state related

set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 protocol vrrp

commit
save

Router 2 (Backup):

# WAN Interface
set interfaces ethernet eth0 address 203.0.113.11/24

# LAN Interface
set interfaces ethernet eth1 address 192.168.1.3/24

# VRRP (lower priority)
set high-availability vrrp group WAN vrid 10
set high-availability vrrp group WAN interface eth0
set high-availability vrrp group WAN address 203.0.113.1/24
set high-availability vrrp group WAN priority 100

set high-availability vrrp group LAN vrid 20
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 100

# Sync Groups
set high-availability vrrp sync-group FAILOVER member WAN
set high-availability vrrp sync-group FAILOVER member LAN

# NAT (same as Router 1)
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

# Firewall (same as Router 1)
set firewall ipv4 input filter default-action drop
set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 state established
set firewall ipv4 input filter rule 10 state related

set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 protocol vrrp

commit
save

HA with Health Check

# VRRP Group
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200

# Track WAN interface
set high-availability vrrp group LAN track interface eth0
set high-availability vrrp group LAN track interface eth0 weight -100

# Health check script
set high-availability vrrp group LAN health-check script '/config/scripts/check-wan.sh'
set high-availability vrrp group LAN health-check interval 10
set high-availability vrrp group LAN health-check failure-count 3

commit

Health Check Script /config/scripts/check-wan.sh:

#!/bin/bash

# Check internet connectivity
ping -c 2 -W 2 8.8.8.8 > /dev/null 2>&1
PING1=$?

ping -c 2 -W 2 1.1.1.1 > /dev/null 2>&1
PING2=$?

# Success if at least one ping works
if [ $PING1 -eq 0 ] || [ $PING2 -eq 0 ]; then
    exit 0
else
    exit 1
fi

HA with Conntrack Sync

# Router 1
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200

set high-availability vrrp sync-group SYNC member LAN

# Conntrack sync
set service conntrack-sync accept-protocol tcp
set service conntrack-sync accept-protocol udp
set service conntrack-sync failover-mechanism vrrp sync-group SYNC
set service conntrack-sync interface eth2
set service conntrack-sync mcast-group 225.0.0.50

# Dedicated sync interface
set interfaces ethernet eth2 address 10.255.255.1/30

commit

Router 2:

set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 100

set high-availability vrrp sync-group SYNC member LAN

set service conntrack-sync accept-protocol tcp
set service conntrack-sync accept-protocol udp
set service conntrack-sync failover-mechanism vrrp sync-group SYNC
set service conntrack-sync interface eth2
set service conntrack-sync mcast-group 225.0.0.50

set interfaces ethernet eth2 address 10.255.255.2/30

commit

Enterprise HA with OSPF

# Router 1
# Physical IPs
set interfaces ethernet eth0 address 203.0.113.2/24
set interfaces ethernet eth1 address 192.168.1.2/24
set interfaces loopback lo address 10.255.255.1/32

# VRRP
set high-availability vrrp group WAN vrid 10
set high-availability vrrp group WAN interface eth0
set high-availability vrrp group WAN address 203.0.113.1/24
set high-availability vrrp group WAN priority 200
set high-availability vrrp group WAN no-preempt

set high-availability vrrp group LAN vrid 20
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200
set high-availability vrrp group LAN no-preempt

# OSPF
set protocols ospf parameters router-id 10.255.255.1
set protocols ospf area 0 network 192.168.1.0/24
set protocols ospf interface eth1 priority 200

# NAT
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

commit

Router 2:

# Physical IPs
set interfaces ethernet eth0 address 203.0.113.3/24
set interfaces ethernet eth1 address 192.168.1.3/24
set interfaces loopback lo address 10.255.255.2/32

# VRRP (lower priority, no preempt)
set high-availability vrrp group WAN vrid 10
set high-availability vrrp group WAN interface eth0
set high-availability vrrp group WAN address 203.0.113.1/24
set high-availability vrrp group WAN priority 100
set high-availability vrrp group WAN no-preempt

set high-availability vrrp group LAN vrid 20
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 100
set high-availability vrrp group LAN no-preempt

# OSPF
set protocols ospf parameters router-id 10.255.255.2
set protocols ospf area 0 network 192.168.1.0/24
set protocols ospf interface eth1 priority 100

# NAT (same configuration)
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

commit

Operational Commands

VRRP Status

run show vrrp

Example output:

Name        Interface      VRID  State    Last Transition
----------  -----------  ------  -------  -----------------
LAN         eth1             10  MASTER   2m30s
WAN         eth0             20  MASTER   2m30s

Group details:

run show vrrp detail

Conntrack Sync Status

run show conntrack-sync statistics

Force Failover

Stop VRRP on the Master for testing:

restart vrrp

Or temporarily lower the priority:

set high-availability vrrp group LAN priority 50
commit

Restore it:

set high-availability vrrp group LAN priority 200
commit

Integration with Cloud Platforms

Yandex Cloud

When deploying VyOS HA in Yandex Cloud, keep the cloud platform’s specifics in mind:

Architecture for Yandex Cloud:

Yandex Cloud VPC
├── Subnet A (ru-central1-a)
│   └── VyOS-1 (MASTER)
│       eth0: 10.0.1.10 (internal)
│       eth1: 192.168.1.2
└── Subnet B (ru-central1-b)
    └── VyOS-2 (BACKUP)
        eth0: 10.0.2.10 (internal)
        eth1: 192.168.1.3

Unicast VRRP for Yandex Cloud:

# Router 1 (in the ru-central1-a zone)
set interfaces ethernet eth0 address 10.0.1.10/24
set interfaces ethernet eth1 address 192.168.1.2/24

# VRRP with unicast (multicast is not supported between zones)
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200
set high-availability vrrp group LAN peer-address 192.168.1.3

# Firewall for VRRP unicast
set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 source address 192.168.1.3
set firewall ipv4 input filter rule 20 destination port 112
set firewall ipv4 input filter rule 20 protocol udp

commit

Router 2 (in the ru-central1-b zone):

set interfaces ethernet eth0 address 10.0.2.10/24
set interfaces ethernet eth1 address 192.168.1.3/24

set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 100
set high-availability vrrp group LAN peer-address 192.168.1.2

set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 source address 192.168.1.2
set firewall ipv4 input filter rule 20 destination port 112
set firewall ipv4 input filter rule 20 protocol udp

commit

Yandex Cloud Network Load Balancer alternative:

For a public IP, use a Network Load Balancer instead of VRRP:

# Configure a health check endpoint on each router
set service https listen-address 10.0.1.10
set service https port 443

# In the Yandex Cloud Console:
# 1. Create a Network Load Balancer
# 2. Target Group: add both VyOS instances
# 3. Health Check: HTTPS :443 path /
# 4. Listener: public IP

VK Cloud

Integrating HA in VK Cloud (Mail.ru Cloud Solutions):

Architecture for VK Cloud:

# Router 1
set interfaces ethernet eth0 address 10.0.1.10/24
set interfaces ethernet eth1 address 192.168.1.2/24

# VRRP on internal interfaces
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200

# Health check for VK Cloud
set high-availability vrrp group LAN health-check script '/config/scripts/check-vk-cloud.sh'
set high-availability vrrp group LAN health-check interval 10

commit

Health Check for VK Cloud:

#!/bin/bash
# /config/scripts/check-vk-cloud.sh

# Check VK Cloud metadata service
curl -f -m 2 http://169.254.169.254/latest/meta-data/ > /dev/null 2>&1
META=$?

# Check internet connectivity
ping -c 1 -W 2 8.8.8.8 > /dev/null 2>&1
PING=$?

# Success if both work
if [ $META -eq 0 ] && [ $PING -eq 0 ]; then
    exit 0
else
    exit 1
fi

Floating IP management via the VK Cloud API:

# Transition script for switching the Floating IP
# /config/scripts/vk-floating-ip.sh

#!/bin/bash

FLOATING_IP="203.0.113.100"
NEW_PORT_ID="port-uuid-of-new-master"
VK_CLOUD_TOKEN="your-auth-token"

# Reassign floating IP to new master
curl -X PUT "https://infra.mail.ru:9696/v2.0/floatingips/${FLOATING_IP}" \
  -H "X-Auth-Token: ${VK_CLOUD_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "{\"floatingip\": {\"port_id\": \"${NEW_PORT_ID}\"}}"

Troubleshooting

VRRP group in BACKUP state on both routers

Causes:

  1. Different VRID:

    show configuration commands | grep vrid

  2. Multicast blocked: Check the switch settings (IGMP snooping may be blocking it).

  3. Firewall blocking VRRP:

    set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 protocol vrrp
commit

  4. Authentication mismatch: Check the passwords on both routers.

VRRP group constantly switching (flapping)

Solutions:

  1. Disable preemption:

    set high-availability vrrp group LAN no-preempt
commit

  2. Add a preempt-delay:

    set high-availability vrrp group LAN preempt-delay 300
commit

  3. Check network stability:

    monitor interfaces ethernet eth1

Conntrack sync not working

Check:

  1. Sync interface is available:

    show interfaces ethernet eth2

  2. The multicast group is the same on both routers

  3. Sync traffic is not blocked:

    set firewall ipv4 input filter rule 30 action accept
set firewall ipv4 input filter rule 30 destination address 225.0.0.50
set firewall ipv4 input filter rule 30 protocol udp
commit

  4. Sync statistics:

    run show conntrack-sync statistics

Clients lose connections during failover

Solution - Conntrack Sync:

Configure conntrack-sync to preserve connection state.

See the “HA with Conntrack Sync” example above.

Best Practices

  1. Use a sync-group to coordinate multiple VRRP groups

  2. no-preempt for production - prevents flapping

  3. Dedicated interface for conntrack-sync

  4. Health check scripts to verify actual availability (not just interface state)

  5. Authentication - use AH for security

  6. Transition scripts - log failover events:

    logger "VRRP $VRRP_GROUP_NAME became $VRRP_STATE"

  7. Test failover regularly - perform planned switchovers

  8. Monitoring - track VRRP state changes

  9. Documentation - record the purpose of each VRRP group

  10. Identical configuration - NAT, firewall, and routing must be identical on both routers

Security

Recommendations

  1. Authentication:

    set high-availability vrrp group LAN authentication type ah
set high-availability vrrp group LAN authentication password 'StrongPassword!'

  2. Firewall for VRRP:

    set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 source address 192.168.1.0/24
set firewall ipv4 input filter rule 20 protocol vrrp

  3. Dedicated VLAN for HA traffic (VRRP, conntrack-sync)

  4. Logging of transition events

  5. Secure transition scripts - verify access permissions

Performance

Optimization

  1. Dedicated interface for conntrack-sync - do not use production interfaces

  2. Health check interval - balance detection speed against overhead:

    set high-availability vrrp group LAN health-check interval 10

  3. Conntrack sync protocols - synchronize only what is necessary:

    set service conntrack-sync accept-protocol tcp
# Do not synchronize UDP unless critical

  4. VRRP advertisement interval - 1 second by default (sufficient for most cases)

Limitations

  • VRRP requires L2 connectivity between routers (broadcast domain)
  • Conntrack sync increases network overhead
  • Not all protocols support stateful failover
  • Health check scripts must be fast (must not block VRRP)

Additional Resources

Next Steps

  • OSPF - dynamic routing in HA
  • BGP - ISP connectivity in HA
  • Firewall - protecting HA infrastructure
  • NAT - NAT in an HA architecture
Reviewed by OpenNix LLC · Last updated on