Load Balancing - WAN Load Balancing

Load Balancing in VyOS is a feature that distributes network traffic across multiple WAN connections to improve fault tolerance and make efficient use of available bandwidth.

Overview

Load Balancing is used for:

WAN Redundancy: Automatic failover when the primary link goes down
Bandwidth Aggregation: Combining the bandwidth of several links
Traffic Distribution: Spreading the load across providers
Cost Optimization: Efficient use of multiple links
High Availability: Continuous operation when hardware or a link fails

Balancing types

VyOS supports several balancing methods:

Method	Description	Use case
Round-robin	Alternating between links in turn	Even distribution
Weighted	Proportional to link weight	Different bandwidths
Source-based	By source IP	Sticky sessions
Destination-based	By destination IP	Specific routes

Architecture

Load Balancing in VyOS works through:

Health monitoring: Checking link availability (ping, TTL)
Failover: Automatic switching to healthy links
Sticky connections: Preserving the route for existing sessions
Rule-based routing: Policy-based routing for balancing

Basic configuration

Dual WAN with automatic failover

# Interface configuration
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'WAN1 - Primary ISP'

set interfaces ethernet eth1 address dhcp
set interfaces ethernet eth1 description 'WAN2 - Backup ISP'

set interfaces ethernet eth2 address 192.168.1.1/24
set interfaces ethernet eth2 description 'LAN'

# Load balancing group
set load-balancing wan interface-health eth0 nexthop dhcp
set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 8.8.8.8

set load-balancing wan interface-health eth1 nexthop dhcp
set load-balancing wan interface-health eth1 test 10 type ping
set load-balancing wan interface-health eth1 test 10 target 1.1.1.1

# Balancing rule
set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 interface eth0 weight 1
set load-balancing wan rule 1 interface eth1 weight 1

# NAT for both links
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

set nat source rule 101 outbound-interface name eth1
set nat source rule 101 source address 192.168.1.0/24
set nat source rule 101 translation address masquerade

commit
save

Active-Backup (Primary-Failover)

# Primary link with a higher weight
set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 interface eth0 weight 100  # Primary
set load-balancing wan rule 1 interface eth1 weight 1    # Backup only

commit
save

Health monitoring with multiple tests

# Multiple tests for reliability
set load-balancing wan interface-health eth0 nexthop dhcp
set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 8.8.8.8
set load-balancing wan interface-health eth0 test 20 type ping
set load-balancing wan interface-health eth0 test 20 target 1.1.1.1

# Failure count - how many times a test must fail
set load-balancing wan interface-health eth0 failure-count 3

commit
save

Advanced configuration

Weighted balancing (different bandwidths)

# WAN1: 100 Mbps (weight 2)
# WAN2: 50 Mbps (weight 1)

set load-balancing wan interface-health eth0 nexthop dhcp
set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 8.8.8.8

set load-balancing wan interface-health eth1 nexthop dhcp
set load-balancing wan interface-health eth1 test 10 type ping
set load-balancing wan interface-health eth1 test 10 target 1.1.1.1

# Rule with 2:1 weights
set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 interface eth0 weight 2
set load-balancing wan rule 1 interface eth1 weight 1

commit
save

Source-based balancing (sticky sessions)

# Balancing by source IP (one client - one link)
set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 interface eth0
set load-balancing wan rule 1 interface eth1
set load-balancing wan rule 1 per-packet-balancing disable  # Sticky sessions

commit
save

Exclusions from balancing

# Main balancing rule
set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 interface eth0
set load-balancing wan rule 1 interface eth1

# Exclusion: VPN traffic only over WAN1
set load-balancing wan rule 10 inbound-interface eth2
set load-balancing wan rule 10 interface eth0
set load-balancing wan rule 10 destination port 500  # IKE
set load-balancing wan rule 10 protocol udp

set load-balancing wan rule 11 inbound-interface eth2
set load-balancing wan rule 11 interface eth0
set load-balancing wan rule 11 destination port 4500  # NAT-T
set load-balancing wan rule 11 protocol udp

commit
save

Balancing by protocol/port

# HTTP/HTTPS over both links
set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 interface eth0
set load-balancing wan rule 1 interface eth1
set load-balancing wan rule 1 destination port 80,443
set load-balancing wan rule 1 protocol tcp

# Email only over WAN1 (for the static IP)
set load-balancing wan rule 10 inbound-interface eth2
set load-balancing wan rule 10 interface eth0
set load-balancing wan rule 10 destination port 25,587
set load-balancing wan rule 10 protocol tcp

# Everything else over both links
set load-balancing wan rule 100 inbound-interface eth2
set load-balancing wan rule 100 interface eth0
set load-balancing wan rule 100 interface eth1

commit
save

TTL-based health check

# TTL test (alternative to ping)
set load-balancing wan interface-health eth0 nexthop dhcp
set load-balancing wan interface-health eth0 test 10 type ttl
set load-balancing wan interface-health eth0 test 10 target 8.8.8.8
set load-balancing wan interface-health eth0 test 10 ttl-limit 1  # Minimum TTL

commit
save

Flush connections on failover

# Reset existing connections on failover
set load-balancing wan flush-connections

commit
save

Configuration examples

Example 1: Dual WAN with even balancing

# WAN interfaces
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'ISP1'

set interfaces ethernet eth1 address dhcp
set interfaces ethernet eth1 description 'ISP2'

# LAN interface
set interfaces ethernet eth2 address 192.168.1.1/24
set interfaces ethernet eth2 description 'LAN'

# Health monitoring
set load-balancing wan interface-health eth0 nexthop dhcp
set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 8.8.8.8
set load-balancing wan interface-health eth0 failure-count 3

set load-balancing wan interface-health eth1 nexthop dhcp
set load-balancing wan interface-health eth1 test 10 type ping
set load-balancing wan interface-health eth1 test 10 target 1.1.1.1
set load-balancing wan interface-health eth1 failure-count 3

# Load balancing rule (50/50)
set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 interface eth0 weight 1
set load-balancing wan rule 1 interface eth1 weight 1
set load-balancing wan rule 1 per-packet-balancing disable

# NAT
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

set nat source rule 101 outbound-interface name eth1
set nat source rule 101 source address 192.168.1.0/24
set nat source rule 101 translation address masquerade

commit
save

Example 2: Primary-Backup configuration

# WAN interfaces
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'Primary ISP (100 Mbps)'

set interfaces ethernet eth1 address dhcp
set interfaces ethernet eth1 description 'Backup ISP (50 Mbps)'

set interfaces ethernet eth2 address 192.168.1.1/24

# Health monitoring
set load-balancing wan interface-health eth0 nexthop dhcp
set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 8.8.8.8

set load-balancing wan interface-health eth1 nexthop dhcp
set load-balancing wan interface-health eth1 test 10 type ping
set load-balancing wan interface-health eth1 test 10 target 1.1.1.1

# Primary-Backup (weight 100:1)
set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 interface eth0 weight 100
set load-balancing wan rule 1 interface eth1 weight 1

# NAT
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

set nat source rule 101 outbound-interface name eth1
set nat source rule 101 source address 192.168.1.0/24
set nat source rule 101 translation address masquerade

commit
save

Example 3: Weighted balancing with exclusions

# WAN interfaces (100 Mbps and 50 Mbps)
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth1 address dhcp
set interfaces ethernet eth2 address 192.168.1.1/24

# Health monitoring
set load-balancing wan interface-health eth0 nexthop dhcp
set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 8.8.8.8

set load-balancing wan interface-health eth1 nexthop dhcp
set load-balancing wan interface-health eth1 test 10 type ping
set load-balancing wan interface-health eth1 test 10 target 1.1.1.1

# VPN always over WAN1 (for a stable IP)
set load-balancing wan rule 10 inbound-interface eth2
set load-balancing wan rule 10 interface eth0
set load-balancing wan rule 10 protocol esp

set load-balancing wan rule 11 inbound-interface eth2
set load-balancing wan rule 11 interface eth0
set load-balancing wan rule 11 destination port 500,4500
set load-balancing wan rule 11 protocol udp

# Main traffic: weighted balancing 2:1
set load-balancing wan rule 100 inbound-interface eth2
set load-balancing wan rule 100 interface eth0 weight 2
set load-balancing wan rule 100 interface eth1 weight 1

# NAT
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

set nat source rule 101 outbound-interface name eth1
set nat source rule 101 source address 192.168.1.0/24
set nat source rule 101 translation address masquerade

commit
save

Example 4: Triple WAN

# Three WAN links
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'ISP1 - Fiber 200 Mbps'

set interfaces ethernet eth1 address dhcp
set interfaces ethernet eth1 description 'ISP2 - Cable 100 Mbps'

set interfaces ethernet eth3 address dhcp
set interfaces ethernet eth3 description 'ISP3 - LTE 50 Mbps (Backup)'

set interfaces ethernet eth2 address 192.168.1.1/24

# Health monitoring for all links
set load-balancing wan interface-health eth0 nexthop dhcp
set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 8.8.8.8

set load-balancing wan interface-health eth1 nexthop dhcp
set load-balancing wan interface-health eth1 test 10 type ping
set load-balancing wan interface-health eth1 test 10 target 1.1.1.1

set load-balancing wan interface-health eth3 nexthop dhcp
set load-balancing wan interface-health eth3 test 10 type ping
set load-balancing wan interface-health eth3 test 10 target 9.9.9.9

# Weighted balancing 4:2:1 (200 Mbps : 100 Mbps : 50 Mbps)
set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 interface eth0 weight 4
set load-balancing wan rule 1 interface eth1 weight 2
set load-balancing wan rule 1 interface eth3 weight 1

# NAT for all
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

set nat source rule 101 outbound-interface name eth1
set nat source rule 101 source address 192.168.1.0/24
set nat source rule 101 translation address masquerade

set nat source rule 102 outbound-interface name eth3
set nat source rule 102 source address 192.168.1.0/24
set nat source rule 102 translation address masquerade

commit
save

Integration with cloud platforms

Yandex Cloud

When deploying Load Balancing in Yandex Cloud, keep the platform’s specifics in mind:

Dual WAN with the Yandex Cloud Internet Gateway:

# Primary link via the Yandex Cloud NAT Gateway
set interfaces ethernet eth0 address 10.0.1.10/24
set interfaces ethernet eth0 description 'Yandex Cloud NAT Gateway'

# Backup link via Elastic IP
set interfaces ethernet eth1 address 10.0.2.10/24
set interfaces ethernet eth1 description 'Elastic IP Backup'

# LAN
set interfaces ethernet eth2 address 192.168.1.1/24

# Health monitoring with Yandex Cloud DNS
set load-balancing wan interface-health eth0 nexthop 10.0.1.1
set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 77.88.8.8  # Yandex DNS

set load-balancing wan interface-health eth1 nexthop 10.0.2.1
set load-balancing wan interface-health eth1 test 10 type ping
set load-balancing wan interface-health eth1 test 10 target 8.8.8.8

# Primary-Backup balancing
set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 interface eth0 weight 100
set load-balancing wan rule 1 interface eth1 weight 1

# Cloud Logging integration
set system syslog host 10.0.0.10 facility daemon level info

commit

Monitoring with Yandex Monitoring:

#!/bin/bash
# /config/scripts/yc-monitoring.sh

# Send metrics to Yandex Monitoring
WAN1_STATUS=$(show load-balancing wan interface-health eth0 | grep -c "reachable")
WAN2_STATUS=$(show load-balancing wan interface-health eth1 | grep -c "reachable")

# Export metrics via Unified Agent
echo "wan1_status $WAN1_STATUS" > /tmp/metrics.txt
echo "wan2_status $WAN2_STATUS" >> /tmp/metrics.txt

VK Cloud

Integrating Load Balancing with VK Cloud (Mail.ru Cloud Solutions):

Dual WAN with VK Cloud:

# Primary via VK Cloud NAT
set interfaces ethernet eth0 address 10.0.1.10/24
set interfaces ethernet eth0 description 'VK Cloud Primary'

# Backup via Floating IP
set interfaces ethernet eth1 address 10.0.2.10/24
set interfaces ethernet eth1 description 'VK Cloud Backup'

set interfaces ethernet eth2 address 192.168.1.1/24

# Health check with the VK Cloud metadata service
set load-balancing wan interface-health eth0 nexthop 10.0.1.1
set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 169.254.169.254
set load-balancing wan interface-health eth0 test 20 type ping
set load-balancing wan interface-health eth0 test 20 target 8.8.8.8

set load-balancing wan interface-health eth1 nexthop 10.0.2.1
set load-balancing wan interface-health eth1 test 10 type ping
set load-balancing wan interface-health eth1 test 10 target 8.8.8.8

# Weighted balancing
set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 interface eth0 weight 2
set load-balancing wan rule 1 interface eth1 weight 1

commit

Monitoring and diagnostics

Viewing load balancing status

# Show load balancing status
show load-balancing wan

# The output includes:
# - Status of each interface (active/inactive)
# - Last health check result
# - Current nexthop
# - Usage statistics

Checking health checks

# Detailed health check information
show load-balancing wan interface-health

# Test status for a specific interface
show load-balancing wan interface-health eth0

Viewing rules

# Load balancing configuration
show configuration load-balancing wan

# Show rules
show configuration load-balancing wan rule

Balancing statistics

# Packet/byte counters per interface
show interfaces ethernet eth0 statistics
show interfaces ethernet eth1 statistics

# Conntrack to verify distribution
sudo conntrack -L | wc -l

Testing failover

# Disable an interface for the test
set interfaces ethernet eth0 disable
commit

# Check the status
show load-balancing wan

# Re-enable it
delete interfaces ethernet eth0 disable
commit

Logging

# Load balancing logs
show log | match "wan lb"
show log | match "load-balancing"

# Real-time monitoring
monitor log | match "wan lb"

Troubleshooting

Problem: Health check keeps failing

Diagnostics:

# Check the status
show load-balancing wan interface-health eth0

# Manual ping check
ping 8.8.8.8 interface eth0 count 5

# Check routing
show ip route

# Check the firewall
show firewall

Solution:

# Change the health check target
delete load-balancing wan interface-health eth0 test 10 target
set load-balancing wan interface-health eth0 test 10 target 1.1.1.1

# Increase the failure count
set load-balancing wan interface-health eth0 failure-count 5

# Use TTL instead of ping
set load-balancing wan interface-health eth0 test 10 type ttl

commit
save

Problem: Balancing does not work

Diagnostics:

# Check the status
show load-balancing wan

# Check the rules
show configuration load-balancing wan rule

# Check NAT
show nat source rules

Solution:

# Make sure NAT is configured for all WANs
set nat source rule 100 outbound-interface name eth0
set nat source rule 101 outbound-interface name eth1

# Check the inbound-interface in the rules
show configuration load-balancing wan rule 1

# Flush connections to refresh
set load-balancing wan flush-connections

commit
save

Problem: Sticky sessions do not work

Cause: Per-packet balancing is enabled.

Solution:

# Disable per-packet balancing
set load-balancing wan rule 1 per-packet-balancing disable

commit
save

Problem: VPN stops working after failover

Cause: VPN requires a stable IP.

Solution:

# Exclude VPN from balancing
set load-balancing wan rule 10 inbound-interface eth2
set load-balancing wan rule 10 interface eth0  # Primary WAN only
set load-balancing wan rule 10 protocol esp

set load-balancing wan rule 11 inbound-interface eth2
set load-balancing wan rule 11 interface eth0
set load-balancing wan rule 11 destination port 500,4500
set load-balancing wan rule 11 protocol udp

commit
save

Best practices

Choose the right balancing method

# Active-Backup - for reliability
set load-balancing wan rule 1 interface eth0 weight 100
set load-balancing wan rule 1 interface eth1 weight 1

# Round-robin - for even utilization
set load-balancing wan rule 1 interface eth0 weight 1
set load-balancing wan rule 1 interface eth1 weight 1

# Weighted - for different bandwidths
set load-balancing wan rule 1 interface eth0 weight 2
set load-balancing wan rule 1 interface eth1 weight 1

Reliable health monitoring

set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 8.8.8.8
set load-balancing wan interface-health eth0 test 20 type ping
set load-balancing wan interface-health eth0 test 20 target 1.1.1.1
set load-balancing wan interface-health eth0 failure-count 3

Sticky sessions for stability

set load-balancing wan rule 1 per-packet-balancing disable

Exclusions for critical services

# VPN always over a single link
set load-balancing wan rule 10 interface eth0
set load-balancing wan rule 10 protocol esp

NAT for all WANs

set nat source rule 100 outbound-interface name eth0
set nat source rule 101 outbound-interface name eth1

Monitoring and alerts

set system task-scheduler task wan-monitor interval '*/5 * * * *'
set system task-scheduler task wan-monitor executable path '/config/scripts/monitor-wan.sh'

Flush connections on failover

set load-balancing wan flush-connections

Document the configuration

set interfaces ethernet eth0 description 'ISP1 - Primary - 100 Mbps'
set interfaces ethernet eth1 description 'ISP2 - Backup - 50 Mbps'

Test failover

set interfaces ethernet eth0 disable
# Verify traffic flows over WAN2
delete interfaces ethernet eth0 disable

Logging

set system syslog file wan-lb.log facility daemon level info

Additional resources

Next steps

Policy Routing - advanced routing
Firewall - protecting WAN interfaces
NAT - NAT for multiple WANs
High Availability - VRRP + Load Balancing

Reviewed by OpenNix LLC · Last updated on 29 July 2026