# Loopback Interfaces in VyOS

> Configure VyOS loopback interfaces - assign a router ID, stable management IP, BGP/OSPF routing and service addresses for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/interfaces/vyos-loopback/



A loopback interface is a virtual interface that is always in the UP state and is used for a variety of network tasks that require a stable IP address regardless of the state of the physical interfaces.

## Overview

### What Is a Loopback

A loopback interface (`lo`) is a virtual network interface that:
- Is always in the UP state (independent of the physical interfaces)
- Does not forward packets onto the physical network
- Is used to identify the router
- Provides a stable connection point for services

**Traditional loopback (127.0.0.1)** is the system loopback for localhost.

**Additional loopback interfaces** are created by the administrator for specific tasks.

### Benefits of Loopback

1. **Stability** - always available, independent of the state of the physical interfaces
2. **Router identification** - a unique IP for the Router ID in routing protocols
3. **Management** - a stable address for administration
4. **Anycast** - using a single IP across many routers
5. **Traffic source** - a stable source IP for outbound connections

### Typical Use Cases

- **Router ID** for OSPF, BGP, MPLS
- **Management** address for SSH, SNMP
- **VPN endpoints** - a stable endpoint for tunnels
- **Service binding** - binding services to the loopback
- **Anycast addressing** - a single IP across many servers
- **Testing** - testing network configurations

## Basic Configuration

### Creating a Loopback Interface

```bash
# Create a loopback with IPv4
set interfaces loopback lo address 10.255.255.1/32

# Description
set interfaces loopback lo description 'Router ID and Management'

commit
save
```

**Note**:
- A `/32` mask means a single host (not a network)
- A loopback typically uses `/32` for IPv4 and `/128` for IPv6

### Multiple IPs on a Loopback

```bash
# Primary IP
set interfaces loopback lo address 10.255.255.1/32

# Additional IPs
set interfaces loopback lo address 10.255.255.2/32
set interfaces loopback lo address 10.255.255.3/32

# IPv6
set interfaces loopback lo address 2001:db8::1/128

commit
```

### Verifying the Loopback

```bash
# Show the loopback interface
show interfaces loopback

# Details
show interfaces loopback lo

# Ping the loopback
ping 10.255.255.1

# Check the state (always UP)
show interfaces loopback lo brief
```

Output:
```
lo: <LOOPBACK,UP,LOWER_UP>
    inet 10.255.255.1/32
    inet 10.255.255.2/32
    inet6 2001:db8::1/128
```

## Using with Routing Protocols

### Loopback as the OSPF Router ID

```bash
# Loopback for the Router ID
set interfaces loopback lo address 10.0.0.1/32
set interfaces loopback lo description 'OSPF Router ID'

# OSPF configuration
set protocols ospf parameters router-id 10.0.0.1

# Advertise the loopback into OSPF
set protocols ospf area 0 network 10.0.0.1/32

# Or bind to the interface
set protocols ospf interface lo area 0
set protocols ospf interface lo passive

commit
```

**Passive interface** - the loopback will not send OSPF Hello packets but will still be advertised into OSPF.

### Loopback for the BGP Router ID

```bash
# Loopback
set interfaces loopback lo address 192.0.2.1/32

# BGP Router ID
set protocols bgp system-as 65001
set protocols bgp parameters router-id 192.0.2.1

# BGP peer with the loopback as update-source
set protocols bgp neighbor 192.0.2.2 remote-as 65002
set protocols bgp neighbor 192.0.2.2 update-source 192.0.2.1
set protocols bgp neighbor 192.0.2.2 address-family ipv4-unicast

commit
```

**Update-source** tells BGP to use the loopback IP as the source for BGP sessions.

### Loopback in Multi-hop eBGP

```bash
# Router A
set interfaces loopback lo address 10.1.1.1/32

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.1.1.1

# eBGP peer over the loopback (multi-hop)
set protocols bgp neighbor 10.2.2.2 remote-as 65002
set protocols bgp neighbor 10.2.2.2 update-source 10.1.1.1
set protocols bgp neighbor 10.2.2.2 ebgp-multihop 255
set protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast

# Route to the peer loopback (via IGP or static)
set protocols static route 10.2.2.2/32 next-hop 203.0.113.2

commit
```

**Router B**:
```bash
set interfaces loopback lo address 10.2.2.2/32

set protocols bgp system-as 65002
set protocols bgp parameters router-id 10.2.2.2

set protocols bgp neighbor 10.1.1.1 remote-as 65001
set protocols bgp neighbor 10.1.1.1 update-source 10.2.2.2
set protocols bgp neighbor 10.1.1.1 ebgp-multihop 255
set protocols bgp neighbor 10.1.1.1 address-family ipv4-unicast

set protocols static route 10.1.1.1/32 next-hop 203.0.113.1

commit
```

### OSPF over Loopback (iBGP next-hop)

```bash
# Router 1
set interfaces loopback lo address 10.0.0.1/32

# OSPF for loopback reachability
set protocols ospf area 0 network 10.0.0.1/32
set protocols ospf interface lo passive

# iBGP peer
set protocols bgp neighbor 10.0.0.2 remote-as 65000
set protocols bgp neighbor 10.0.0.2 update-source 10.0.0.1

commit
```

**Router 2**:
```bash
set interfaces loopback lo address 10.0.0.2/32

set protocols ospf area 0 network 10.0.0.2/32
set protocols ospf interface lo passive

set protocols bgp neighbor 10.0.0.1 remote-as 65000
set protocols bgp neighbor 10.0.0.1 update-source 10.0.0.2

commit
```

OSPF provides reachability between the loopback addresses, and BGP uses these addresses for peering.

## Management and Services

### SSH on a Loopback

```bash
# Loopback for management
set interfaces loopback lo address 172.16.255.1/32
set interfaces loopback lo description 'Management Interface'

# SSH listen on the loopback
set service ssh listen-address 172.16.255.1
set service ssh port 22

commit
```

Benefit: SSH remains reachable as long as the router has at least one active connection to the network.

### SNMP on a Loopback

```bash
# SNMP on the loopback
set service snmp listen-address 172.16.255.1 port 161

# SNMP community
set service snmp community public authorization ro
set service snmp community public network 192.168.1.0/24

commit
```

### NTP Server on a Loopback

```bash
# NTP server
set service ntp server 0.pool.ntp.org
set service ntp server 1.pool.ntp.org

# NTP listen on the loopback
set service ntp listen-address 172.16.255.1

# NTP allow-client
set service ntp allow-client address 192.168.0.0/16

commit
```

### Syslog Source

```bash
# Loopback for the syslog source
set interfaces loopback lo address 10.10.10.1/32

# Syslog with a loopback source
set system syslog host 192.168.1.100 facility all level info
set system syslog host 192.168.1.100 source-address 10.10.10.1

commit
```

## VPN and Tunneling

### VPN Endpoint on a Loopback

#### IPsec with a Loopback

```bash
# Loopback
set interfaces loopback lo address 10.100.0.1/32

# Advertise into OSPF for reachability
set protocols ospf area 0 network 10.100.0.1/32

# IPsec with a loopback local-address
set vpn ipsec site-to-site peer remote authentication mode pre-shared-secret
set vpn ipsec site-to-site peer remote authentication pre-shared-secret 'secret'
set vpn ipsec site-to-site peer remote local-address 10.100.0.1
set vpn ipsec site-to-site peer remote remote-address 10.100.0.2
# ... (IKE, ESP configuration)

commit
```

#### WireGuard with a Loopback

```bash
# Loopback
set interfaces loopback lo address 10.200.0.1/32

# WireGuard
set interfaces wireguard wg0 address 192.168.200.1/24
set interfaces wireguard wg0 port 51820

# Peer
set interfaces wireguard wg0 peer peer1 address 10.200.0.2
set interfaces wireguard wg0 peer peer1 allowed-ips 192.168.201.0/24
set interfaces wireguard wg0 peer peer1 public-key '<public-key>'

commit
```

### GRE Tunnel with Loopback Endpoints

```bash
# Loopback
set interfaces loopback lo address 10.0.1.1/32

# GRE tunnel with loopback endpoints
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 10.0.1.1
set interfaces tunnel tun0 remote 10.0.1.2
set interfaces tunnel tun0 address 172.16.10.1/30

# OSPF for loopback reachability
set protocols ospf area 0 network 10.0.1.1/32

commit
```

## Anycast with Loopback

### DNS Anycast

Using a single IP across many DNS servers:

```bash
# The same anycast IP on all DNS servers
set interfaces loopback lo address 192.0.2.53/32
set interfaces loopback lo description 'DNS Anycast'

# Advertise into OSPF/BGP
set protocols ospf area 0 network 192.0.2.53/32
set protocols ospf interface lo passive

# DNS service on the anycast IP
set service dns forwarding listen-address 192.0.2.53
set service dns forwarding allow-from 0.0.0.0/0

commit
```

Clients use `192.0.2.53` as their DNS, and requests go to the nearest server based on the routing metric.

### Load Balancer Anycast

```bash
# Anycast IP for load balancers
set interfaces loopback lo address 203.0.113.100/32
set interfaces loopback lo description 'LB Anycast VIP'

# BGP for advertising
set protocols bgp system-as 65001
set protocols bgp address-family ipv4-unicast network 203.0.113.100/32

commit
```

## Advanced Configurations

### Multiple Loopback Interfaces

VyOS supports only a single loopback interface `lo`, but you can add multiple IPs to it:

```bash
# Router ID loopback IPs
set interfaces loopback lo address 10.255.0.1/32
set interfaces loopback lo address 10.255.0.2/32

# Management IPs
set interfaces loopback lo address 172.16.0.1/32

# Service IPs
set interfaces loopback lo address 192.168.255.1/32

# IPv6
set interfaces loopback lo address 2001:db8:ffff::1/128

commit
```

### Loopback for Testing

```bash
# Test loopback
set interfaces loopback lo address 198.51.100.1/32
set interfaces loopback lo description 'Testing'

# Static route via the loopback (blackhole)
set protocols static route 10.0.0.0/8 blackhole distance 254

commit
```

### Loopback in a VRF

```bash
# VRF instance
set vrf name CUSTOMER-A table 100

# Loopback in the VRF
set interfaces loopback lo vrf CUSTOMER-A
set interfaces loopback lo address 10.100.0.1/32

commit
```

**Note**: In VyOS the loopback is usually in the default VRF. Use dummy interfaces for a VRF-specific loopback.

### Policy Routing with a Loopback

```bash
# Loopback for a specific source
set interfaces loopback lo address 203.0.113.1/32

# Policy route
set policy route PBR rule 10 source address 192.168.1.0/24
set policy route PBR rule 10 set source-address 203.0.113.1

# Apply to the interface
set interfaces ethernet eth1 policy route PBR

commit
```

Traffic from 192.168.1.0/24 will have source IP 203.0.113.1 (loopback).

## Monitoring and Diagnostics

### Checking the Loopback

```bash
# Show all loopbacks
show interfaces loopback

# Details
show interfaces loopback lo

# Brief
show interfaces loopback lo brief

# Statistics (usually zero for a loopback)
show interfaces loopback lo statistics
```

### Checking Reachability

```bash
# Ping the loopback
ping 10.255.255.1

# Ping from another router
ping 10.255.255.1 source-address 192.168.1.1

# Traceroute
traceroute 10.255.255.1
```

### Checking in Routing Protocols

```bash
# OSPF
show ip ospf route

# BGP
show ip bgp 10.255.255.1/32

# Routing table
show ip route 10.255.255.1
```

### tcpdump on a Loopback

```bash
# Capture traffic on the loopback (usually empty)
sudo tcpdump -i lo -n

# System loopback (127.0.0.1)
sudo tcpdump -i lo -n host 127.0.0.1
```

## Troubleshooting

### Loopback Is Unreachable from Other Routers

**Problem**: The loopback IP cannot be pinged from other routers.

**Causes**:
1. The loopback is not advertised into a routing protocol
2. A firewall is blocking it
3. The routing table does not contain a route

**Diagnostics**:
```bash
# Check advertising
show ip ospf route
show ip bgp

# Firewall
show firewall ipv4 input filter

# On the remote router, check routing
show ip route 10.255.255.1
```

**Solution**:
```bash
# Add to OSPF
set protocols ospf area 0 network 10.255.255.1/32
set protocols ospf interface lo passive

# Or BGP
set protocols bgp address-family ipv4-unicast network 10.255.255.1/32

# Firewall (allow ICMP)
set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 protocol icmp

commit
```

### BGP Session Does Not Establish over a Loopback

**Problem**: The BGP neighbor (loopback IP) is in the Idle/Active state.

**Causes**:
1. No reachability to the peer loopback
2. ebgp-multihop is not configured
3. A firewall is blocking BGP (TCP 179)

**Diagnostics**:
```bash
# Ping the peer loopback
ping 10.0.0.2 source-address 10.0.0.1

# BGP summary
show ip bgp summary

# BGP neighbor details
show ip bgp neighbors 10.0.0.2
```

**Solution**:
```bash
# For eBGP: ebgp-multihop
set protocols bgp neighbor 10.0.0.2 ebgp-multihop 255

# Firewall
set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 destination port 179
set firewall ipv4 input filter rule 20 protocol tcp

commit
```

### Service Does Not Listen on the Loopback

**Problem**: SSH/SNMP is not reachable on the loopback IP.

**Diagnostics**:
```bash
# Check listening ports
netstat -tlnp | grep 22

# Check the SSH configuration
show service ssh
```

**Solution**:
```bash
# SSH listen on the loopback
set service ssh listen-address 172.16.255.1

# Or on all interfaces
set service ssh listen-address 0.0.0.0

commit
```

## Configuration Examples

### Example 1: OSPF Router ID and Management

```bash
# Loopback for the Router ID and management
set interfaces loopback lo address 10.0.0.1/32
set interfaces loopback lo description 'Router ID and Management'

# OSPF
set protocols ospf parameters router-id 10.0.0.1
set protocols ospf area 0 network 10.0.0.1/32
set protocols ospf interface lo passive

# SSH on the loopback
set service ssh listen-address 10.0.0.1

# SNMP on the loopback
set service snmp listen-address 10.0.0.1

commit
save
```

### Example 2: iBGP Full Mesh with Loopback

**Router 1**:
```bash
set interfaces loopback lo address 10.255.0.1/32

# OSPF for reachability
set protocols ospf parameters router-id 10.255.0.1
set protocols ospf area 0 network 10.255.0.1/32
set protocols ospf interface lo passive

# iBGP
set protocols bgp system-as 65000
set protocols bgp parameters router-id 10.255.0.1

set protocols bgp neighbor 10.255.0.2 remote-as 65000
set protocols bgp neighbor 10.255.0.2 update-source 10.255.0.1
set protocols bgp neighbor 10.255.0.2 address-family ipv4-unicast

set protocols bgp neighbor 10.255.0.3 remote-as 65000
set protocols bgp neighbor 10.255.0.3 update-source 10.255.0.1
set protocols bgp neighbor 10.255.0.3 address-family ipv4-unicast

commit
```

**Routers 2 and 3** - configured the same way with their respective loopback IPs.

### Example 3: Anycast DNS

**DNS Server 1** (Site A):
```bash
# Anycast IP
set interfaces loopback lo address 192.0.2.53/32
set interfaces loopback lo description 'DNS Anycast'

# Real management IP
set interfaces loopback lo address 10.1.1.1/32

# OSPF advertising the anycast address
set protocols ospf area 0 network 192.0.2.53/32
set protocols ospf interface lo passive

# DNS on the anycast IP
set service dns forwarding listen-address 192.0.2.53
set service dns forwarding allow-from 0.0.0.0/0
set service dns forwarding name-server 8.8.8.8

commit
```

**DNS Server 2** (Site B):
```bash
# The same anycast IP
set interfaces loopback lo address 192.0.2.53/32
set interfaces loopback lo description 'DNS Anycast'

# Its own management IP
set interfaces loopback lo address 10.2.2.2/32

# OSPF
set protocols ospf area 0 network 192.0.2.53/32
set protocols ospf interface lo passive

# DNS
set service dns forwarding listen-address 192.0.2.53
set service dns forwarding allow-from 0.0.0.0/0
set service dns forwarding name-server 8.8.8.8

commit
```

Clients use `192.0.2.53`, and requests go to the nearest DNS server.

### Example 4: Multi-hop eBGP over a Loopback

**Router A (AS 65001)**:
```bash
# Loopback
set interfaces loopback lo address 10.1.1.1/32

# Physical interface to Router B
set interfaces ethernet eth0 address 203.0.113.1/30

# Static route to the peer loopback
set protocols static route 10.2.2.2/32 next-hop 203.0.113.2

# BGP
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.1.1.1

set protocols bgp neighbor 10.2.2.2 remote-as 65002
set protocols bgp neighbor 10.2.2.2 update-source 10.1.1.1
set protocols bgp neighbor 10.2.2.2 ebgp-multihop 255
set protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast

commit
```

**Router B (AS 65002)**:
```bash
set interfaces loopback lo address 10.2.2.2/32
set interfaces ethernet eth0 address 203.0.113.2/30

set protocols static route 10.1.1.1/32 next-hop 203.0.113.1

set protocols bgp system-as 65002
set protocols bgp parameters router-id 10.2.2.2

set protocols bgp neighbor 10.1.1.1 remote-as 65001
set protocols bgp neighbor 10.1.1.1 update-source 10.2.2.2
set protocols bgp neighbor 10.1.1.1 ebgp-multihop 255
set protocols bgp neighbor 10.1.1.1 address-family ipv4-unicast

commit
```

## Best Practices

1. **Use a /32 mask for IPv4 loopbacks**:
   ```bash
   set interfaces loopback lo address 10.255.255.1/32
   ```

2. **Unique loopback IPs**:
   - Each router must have a unique loopback IP
   - Use a logical scheme (10.0.router-id.1)

3. **Router ID from the loopback**:
   - OSPF/BGP Router ID = loopback IP
   - Ensures stability

4. **Advertise the loopback into the IGP**:
   - OSPF/BGP must know about the loopback
   - Use a passive interface

5. **Management on the loopback**:
   - SSH, SNMP on the loopback IP
   - Stable access independent of the physical interfaces

6. **Descriptions**:
   ```bash
   set interfaces loopback lo description 'Router ID: 10.0.0.1, OSPF/BGP'
   ```

7. **IPv6 loopback**:
   ```bash
   set interfaces loopback lo address 2001:db8::1/128
   ```

8. **Document the purpose**:
   - Which IPs are for the Router ID
   - Which are for management
   - Which are for anycast

9. **Firewall for the loopback**:
   - Protect management services
   - Rate limiting for ICMP

10. **Monitoring**:
    - Track loopback availability
    - Alerts if the loopback becomes unreachable

## Conclusion

Loopback interfaces are a critically important component of the network infrastructure, providing:

- **A stable Router ID** for routing protocols
- **A reliable management** interface
- **Anycast addressing** for distributed services
- **A stable endpoint** for VPN and tunneling

Key use cases:
- Router ID for OSPF/BGP
- Management access (SSH, SNMP)
- BGP peering over a loopback (iBGP)
- Anycast services (DNS, load balancing)
- VPN endpoints
- Source IP for syslog, NTP

Proper use of loopback interfaces improves the stability and manageability of the network infrastructure.