Documentation
VyOS Documentation
VyOS Interfaces
Loopback Interfaces in VyOS

Loopback Interfaces in VyOS

A loopback interface is a virtual interface that is always in the UP state and is used for a variety of network tasks that require a stable IP address regardless of the state of the physical interfaces.

Overview

What Is a Loopback

A loopback interface (lo) is a virtual network interface that:

  • Is always in the UP state (independent of the physical interfaces)
  • Does not forward packets onto the physical network
  • Is used to identify the router
  • Provides a stable connection point for services

Traditional loopback (127.0.0.1) is the system loopback for localhost.

Additional loopback interfaces are created by the administrator for specific tasks.

Benefits of Loopback

  1. Stability - always available, independent of the state of the physical interfaces
  2. Router identification - a unique IP for the Router ID in routing protocols
  3. Management - a stable address for administration
  4. Anycast - using a single IP across many routers
  5. Traffic source - a stable source IP for outbound connections

Typical Use Cases

  • Router ID for OSPF, BGP, MPLS
  • Management address for SSH, SNMP
  • VPN endpoints - a stable endpoint for tunnels
  • Service binding - binding services to the loopback
  • Anycast addressing - a single IP across many servers
  • Testing - testing network configurations

Basic Configuration

Creating a Loopback Interface

# Create a loopback with IPv4
set interfaces loopback lo address 10.255.255.1/32

# Description
set interfaces loopback lo description 'Router ID and Management'

commit
save

Note:

  • A /32 mask means a single host (not a network)
  • A loopback typically uses /32 for IPv4 and /128 for IPv6

Multiple IPs on a Loopback

# Primary IP
set interfaces loopback lo address 10.255.255.1/32

# Additional IPs
set interfaces loopback lo address 10.255.255.2/32
set interfaces loopback lo address 10.255.255.3/32

# IPv6
set interfaces loopback lo address 2001:db8::1/128

commit

Verifying the Loopback

# Show the loopback interface
show interfaces loopback

# Details
show interfaces loopback lo

# Ping the loopback
ping 10.255.255.1

# Check the state (always UP)
show interfaces loopback lo brief

Output:

lo: <LOOPBACK,UP,LOWER_UP>
    inet 10.255.255.1/32
    inet 10.255.255.2/32
    inet6 2001:db8::1/128

Using with Routing Protocols

Loopback as the OSPF Router ID

# Loopback for the Router ID
set interfaces loopback lo address 10.0.0.1/32
set interfaces loopback lo description 'OSPF Router ID'

# OSPF configuration
set protocols ospf parameters router-id 10.0.0.1

# Advertise the loopback into OSPF
set protocols ospf area 0 network 10.0.0.1/32

# Or bind to the interface
set protocols ospf interface lo area 0
set protocols ospf interface lo passive

commit

Passive interface - the loopback will not send OSPF Hello packets but will still be advertised into OSPF.

Loopback for the BGP Router ID

# Loopback
set interfaces loopback lo address 192.0.2.1/32

# BGP Router ID
set protocols bgp system-as 65001
set protocols bgp parameters router-id 192.0.2.1

# BGP peer with the loopback as update-source
set protocols bgp neighbor 192.0.2.2 remote-as 65002
set protocols bgp neighbor 192.0.2.2 update-source 192.0.2.1
set protocols bgp neighbor 192.0.2.2 address-family ipv4-unicast

commit

Update-source tells BGP to use the loopback IP as the source for BGP sessions.

Loopback in Multi-hop eBGP

# Router A
set interfaces loopback lo address 10.1.1.1/32

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.1.1.1

# eBGP peer over the loopback (multi-hop)
set protocols bgp neighbor 10.2.2.2 remote-as 65002
set protocols bgp neighbor 10.2.2.2 update-source 10.1.1.1
set protocols bgp neighbor 10.2.2.2 ebgp-multihop 255
set protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast

# Route to the peer loopback (via IGP or static)
set protocols static route 10.2.2.2/32 next-hop 203.0.113.2

commit

Router B:

set interfaces loopback lo address 10.2.2.2/32

set protocols bgp system-as 65002
set protocols bgp parameters router-id 10.2.2.2

set protocols bgp neighbor 10.1.1.1 remote-as 65001
set protocols bgp neighbor 10.1.1.1 update-source 10.2.2.2
set protocols bgp neighbor 10.1.1.1 ebgp-multihop 255
set protocols bgp neighbor 10.1.1.1 address-family ipv4-unicast

set protocols static route 10.1.1.1/32 next-hop 203.0.113.1

commit

OSPF over Loopback (iBGP next-hop)

# Router 1
set interfaces loopback lo address 10.0.0.1/32

# OSPF for loopback reachability
set protocols ospf area 0 network 10.0.0.1/32
set protocols ospf interface lo passive

# iBGP peer
set protocols bgp neighbor 10.0.0.2 remote-as 65000
set protocols bgp neighbor 10.0.0.2 update-source 10.0.0.1

commit

Router 2:

set interfaces loopback lo address 10.0.0.2/32

set protocols ospf area 0 network 10.0.0.2/32
set protocols ospf interface lo passive

set protocols bgp neighbor 10.0.0.1 remote-as 65000
set protocols bgp neighbor 10.0.0.1 update-source 10.0.0.2

commit

OSPF provides reachability between the loopback addresses, and BGP uses these addresses for peering.

Management and Services

SSH on a Loopback

# Loopback for management
set interfaces loopback lo address 172.16.255.1/32
set interfaces loopback lo description 'Management Interface'

# SSH listen on the loopback
set service ssh listen-address 172.16.255.1
set service ssh port 22

commit

Benefit: SSH remains reachable as long as the router has at least one active connection to the network.

SNMP on a Loopback

# SNMP on the loopback
set service snmp listen-address 172.16.255.1 port 161

# SNMP community
set service snmp community public authorization ro
set service snmp community public network 192.168.1.0/24

commit

NTP Server on a Loopback

# NTP server
set service ntp server 0.pool.ntp.org
set service ntp server 1.pool.ntp.org

# NTP listen on the loopback
set service ntp listen-address 172.16.255.1

# NTP allow-client
set service ntp allow-client address 192.168.0.0/16

commit

Syslog Source

# Loopback for the syslog source
set interfaces loopback lo address 10.10.10.1/32

# Syslog with a loopback source
set system syslog host 192.168.1.100 facility all level info
set system syslog host 192.168.1.100 source-address 10.10.10.1

commit

VPN and Tunneling

VPN Endpoint on a Loopback

IPsec with a Loopback

# Loopback
set interfaces loopback lo address 10.100.0.1/32

# Advertise into OSPF for reachability
set protocols ospf area 0 network 10.100.0.1/32

# IPsec with a loopback local-address
set vpn ipsec site-to-site peer remote authentication mode pre-shared-secret
set vpn ipsec site-to-site peer remote authentication pre-shared-secret 'secret'
set vpn ipsec site-to-site peer remote local-address 10.100.0.1
set vpn ipsec site-to-site peer remote remote-address 10.100.0.2
# ... (IKE, ESP configuration)

commit

WireGuard with a Loopback

# Loopback
set interfaces loopback lo address 10.200.0.1/32

# WireGuard
set interfaces wireguard wg0 address 192.168.200.1/24
set interfaces wireguard wg0 port 51820

# Peer
set interfaces wireguard wg0 peer peer1 address 10.200.0.2
set interfaces wireguard wg0 peer peer1 allowed-ips 192.168.201.0/24
set interfaces wireguard wg0 peer peer1 public-key '<public-key>'

commit

GRE Tunnel with Loopback Endpoints

# Loopback
set interfaces loopback lo address 10.0.1.1/32

# GRE tunnel with loopback endpoints
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 10.0.1.1
set interfaces tunnel tun0 remote 10.0.1.2
set interfaces tunnel tun0 address 172.16.10.1/30

# OSPF for loopback reachability
set protocols ospf area 0 network 10.0.1.1/32

commit

Anycast with Loopback

DNS Anycast

Using a single IP across many DNS servers:

# The same anycast IP on all DNS servers
set interfaces loopback lo address 192.0.2.53/32
set interfaces loopback lo description 'DNS Anycast'

# Advertise into OSPF/BGP
set protocols ospf area 0 network 192.0.2.53/32
set protocols ospf interface lo passive

# DNS service on the anycast IP
set service dns forwarding listen-address 192.0.2.53
set service dns forwarding allow-from 0.0.0.0/0

commit

Clients use 192.0.2.53 as their DNS, and requests go to the nearest server based on the routing metric.

Load Balancer Anycast

# Anycast IP for load balancers
set interfaces loopback lo address 203.0.113.100/32
set interfaces loopback lo description 'LB Anycast VIP'

# BGP for advertising
set protocols bgp system-as 65001
set protocols bgp address-family ipv4-unicast network 203.0.113.100/32

commit

Advanced Configurations

Multiple Loopback Interfaces

VyOS supports only a single loopback interface lo, but you can add multiple IPs to it:

# Router ID loopback IPs
set interfaces loopback lo address 10.255.0.1/32
set interfaces loopback lo address 10.255.0.2/32

# Management IPs
set interfaces loopback lo address 172.16.0.1/32

# Service IPs
set interfaces loopback lo address 192.168.255.1/32

# IPv6
set interfaces loopback lo address 2001:db8:ffff::1/128

commit

Loopback for Testing

# Test loopback
set interfaces loopback lo address 198.51.100.1/32
set interfaces loopback lo description 'Testing'

# Static route via the loopback (blackhole)
set protocols static route 10.0.0.0/8 blackhole distance 254

commit

Loopback in a VRF

# VRF instance
set vrf name CUSTOMER-A table 100

# Loopback in the VRF
set interfaces loopback lo vrf CUSTOMER-A
set interfaces loopback lo address 10.100.0.1/32

commit

Note: In VyOS the loopback is usually in the default VRF. Use dummy interfaces for a VRF-specific loopback.

Policy Routing with a Loopback

# Loopback for a specific source
set interfaces loopback lo address 203.0.113.1/32

# Policy route
set policy route PBR rule 10 source address 192.168.1.0/24
set policy route PBR rule 10 set source-address 203.0.113.1

# Apply to the interface
set interfaces ethernet eth1 policy route PBR

commit

Traffic from 192.168.1.0/24 will have source IP 203.0.113.1 (loopback).

Monitoring and Diagnostics

Checking the Loopback

# Show all loopbacks
show interfaces loopback

# Details
show interfaces loopback lo

# Brief
show interfaces loopback lo brief

# Statistics (usually zero for a loopback)
show interfaces loopback lo statistics

Checking Reachability

# Ping the loopback
ping 10.255.255.1

# Ping from another router
ping 10.255.255.1 source-address 192.168.1.1

# Traceroute
traceroute 10.255.255.1

Checking in Routing Protocols

# OSPF
show ip ospf route

# BGP
show ip bgp 10.255.255.1/32

# Routing table
show ip route 10.255.255.1

tcpdump on a Loopback

# Capture traffic on the loopback (usually empty)
sudo tcpdump -i lo -n

# System loopback (127.0.0.1)
sudo tcpdump -i lo -n host 127.0.0.1

Troubleshooting

Loopback Is Unreachable from Other Routers

Problem: The loopback IP cannot be pinged from other routers.

Causes:

  1. The loopback is not advertised into a routing protocol
  2. A firewall is blocking it
  3. The routing table does not contain a route

Diagnostics:

# Check advertising
show ip ospf route
show ip bgp

# Firewall
show firewall ipv4 input filter

# On the remote router, check routing
show ip route 10.255.255.1

Solution:

# Add to OSPF
set protocols ospf area 0 network 10.255.255.1/32
set protocols ospf interface lo passive

# Or BGP
set protocols bgp address-family ipv4-unicast network 10.255.255.1/32

# Firewall (allow ICMP)
set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 protocol icmp

commit

BGP Session Does Not Establish over a Loopback

Problem: The BGP neighbor (loopback IP) is in the Idle/Active state.

Causes:

  1. No reachability to the peer loopback
  2. ebgp-multihop is not configured
  3. A firewall is blocking BGP (TCP 179)

Diagnostics:

# Ping the peer loopback
ping 10.0.0.2 source-address 10.0.0.1

# BGP summary
show ip bgp summary

# BGP neighbor details
show ip bgp neighbors 10.0.0.2

Solution:

# For eBGP: ebgp-multihop
set protocols bgp neighbor 10.0.0.2 ebgp-multihop 255

# Firewall
set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 destination port 179
set firewall ipv4 input filter rule 20 protocol tcp

commit

Service Does Not Listen on the Loopback

Problem: SSH/SNMP is not reachable on the loopback IP.

Diagnostics:

# Check listening ports
netstat -tlnp | grep 22

# Check the SSH configuration
show service ssh

Solution:

# SSH listen on the loopback
set service ssh listen-address 172.16.255.1

# Or on all interfaces
set service ssh listen-address 0.0.0.0

commit

Configuration Examples

Example 1: OSPF Router ID and Management

# Loopback for the Router ID and management
set interfaces loopback lo address 10.0.0.1/32
set interfaces loopback lo description 'Router ID and Management'

# OSPF
set protocols ospf parameters router-id 10.0.0.1
set protocols ospf area 0 network 10.0.0.1/32
set protocols ospf interface lo passive

# SSH on the loopback
set service ssh listen-address 10.0.0.1

# SNMP on the loopback
set service snmp listen-address 10.0.0.1

commit
save

Example 2: iBGP Full Mesh with Loopback

Router 1:

set interfaces loopback lo address 10.255.0.1/32

# OSPF for reachability
set protocols ospf parameters router-id 10.255.0.1
set protocols ospf area 0 network 10.255.0.1/32
set protocols ospf interface lo passive

# iBGP
set protocols bgp system-as 65000
set protocols bgp parameters router-id 10.255.0.1

set protocols bgp neighbor 10.255.0.2 remote-as 65000
set protocols bgp neighbor 10.255.0.2 update-source 10.255.0.1
set protocols bgp neighbor 10.255.0.2 address-family ipv4-unicast

set protocols bgp neighbor 10.255.0.3 remote-as 65000
set protocols bgp neighbor 10.255.0.3 update-source 10.255.0.1
set protocols bgp neighbor 10.255.0.3 address-family ipv4-unicast

commit

Routers 2 and 3 - configured the same way with their respective loopback IPs.

Example 3: Anycast DNS

DNS Server 1 (Site A):

# Anycast IP
set interfaces loopback lo address 192.0.2.53/32
set interfaces loopback lo description 'DNS Anycast'

# Real management IP
set interfaces loopback lo address 10.1.1.1/32

# OSPF advertising the anycast address
set protocols ospf area 0 network 192.0.2.53/32
set protocols ospf interface lo passive

# DNS on the anycast IP
set service dns forwarding listen-address 192.0.2.53
set service dns forwarding allow-from 0.0.0.0/0
set service dns forwarding name-server 8.8.8.8

commit

DNS Server 2 (Site B):

# The same anycast IP
set interfaces loopback lo address 192.0.2.53/32
set interfaces loopback lo description 'DNS Anycast'

# Its own management IP
set interfaces loopback lo address 10.2.2.2/32

# OSPF
set protocols ospf area 0 network 192.0.2.53/32
set protocols ospf interface lo passive

# DNS
set service dns forwarding listen-address 192.0.2.53
set service dns forwarding allow-from 0.0.0.0/0
set service dns forwarding name-server 8.8.8.8

commit

Clients use 192.0.2.53, and requests go to the nearest DNS server.

Example 4: Multi-hop eBGP over a Loopback

Router A (AS 65001):

# Loopback
set interfaces loopback lo address 10.1.1.1/32

# Physical interface to Router B
set interfaces ethernet eth0 address 203.0.113.1/30

# Static route to the peer loopback
set protocols static route 10.2.2.2/32 next-hop 203.0.113.2

# BGP
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.1.1.1

set protocols bgp neighbor 10.2.2.2 remote-as 65002
set protocols bgp neighbor 10.2.2.2 update-source 10.1.1.1
set protocols bgp neighbor 10.2.2.2 ebgp-multihop 255
set protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast

commit

Router B (AS 65002):

set interfaces loopback lo address 10.2.2.2/32
set interfaces ethernet eth0 address 203.0.113.2/30

set protocols static route 10.1.1.1/32 next-hop 203.0.113.1

set protocols bgp system-as 65002
set protocols bgp parameters router-id 10.2.2.2

set protocols bgp neighbor 10.1.1.1 remote-as 65001
set protocols bgp neighbor 10.1.1.1 update-source 10.2.2.2
set protocols bgp neighbor 10.1.1.1 ebgp-multihop 255
set protocols bgp neighbor 10.1.1.1 address-family ipv4-unicast

commit

Best Practices

  1. Use a /32 mask for IPv4 loopbacks:

    set interfaces loopback lo address 10.255.255.1/32

  2. Unique loopback IPs:

    • Each router must have a unique loopback IP
    • Use a logical scheme (10.0.router-id.1)

  3. Router ID from the loopback:

    • OSPF/BGP Router ID = loopback IP
    • Ensures stability

  4. Advertise the loopback into the IGP:

    • OSPF/BGP must know about the loopback
    • Use a passive interface

  5. Management on the loopback:

    • SSH, SNMP on the loopback IP
    • Stable access independent of the physical interfaces

  6. Descriptions:

    set interfaces loopback lo description 'Router ID: 10.0.0.1, OSPF/BGP'

  7. IPv6 loopback:

    set interfaces loopback lo address 2001:db8::1/128

  8. Document the purpose:

    • Which IPs are for the Router ID
    • Which are for management
    • Which are for anycast

  9. Firewall for the loopback:

    • Protect management services
    • Rate limiting for ICMP

  10. Monitoring:

    • Track loopback availability
    • Alerts if the loopback becomes unreachable

Conclusion

Loopback interfaces are a critically important component of the network infrastructure, providing:

  • A stable Router ID for routing protocols
  • A reliable management interface
  • Anycast addressing for distributed services
  • A stable endpoint for VPN and tunneling

Key use cases:

  • Router ID for OSPF/BGP
  • Management access (SSH, SNMP)
  • BGP peering over a loopback (iBGP)
  • Anycast services (DNS, load balancing)
  • VPN endpoints
  • Source IP for syslog, NTP

Proper use of loopback interfaces improves the stability and manageability of the network infrastructure.

Reviewed by OpenNix LLC · Last updated on
VTI Interfaces (Virtual Tunnel Interface) in VyOSPseudo-Ethernet (MACVLAN) Interfaces in VyOS