Policy Routing (PBR) - Policy-Based Routing

Policy-based routing (PBR) lets you route traffic based on policies rather than the destination IP address alone. PBR provides flexibility in managing traffic flows, allowing decisions to be made based on source IP, protocol, port, and other parameters.

Overview

What Is Policy Routing

Traditional routing:

Decisions based on the destination IP only
Uses the routing table
Longest prefix match

Policy-based routing (PBR):

Decisions based on multiple criteria
Source IP, destination IP, protocol, ports, DSCP
Higher priority than the routing table
Flexible traffic control

Core Concepts

Route Map:

A set of rules
Each rule has a number and an action
Match conditions and set actions

Match Criteria:

Source/destination IP address
Protocol (TCP, UDP, ICMP)
Ports (source/destination)
DSCP/TOS
Packet length
Interface

Set Actions:

Next-hop IP
Interface
Source address (NAT)
Table (routing table)
DSCP/TOS

When to Use PBR

Typical scenarios:

Multi-homing - different traffic through different ISPs
QoS - prioritizing critical traffic
Load balancing - distributing load
Traffic engineering - optimizing paths
Security - traffic isolation
Cost optimization - cheaper/expensive links

Basic Configuration

Simple Policy Route

Direct traffic from a specific subnet through a specific gateway:

# Policy route map
set policy route POLICY-1 rule 10 source address 192.168.1.0/24
set policy route POLICY-1 rule 10 set next-hop 203.0.113.1

# Default action (permit all remaining traffic)
set policy route POLICY-1 rule 999 action permit

# Apply to the interface (inbound traffic)
set interfaces ethernet eth1 policy route POLICY-1

commit
save

How it works:

Traffic arrives on eth1
The source IP is checked against the rules
If it matches 192.168.1.0/24 → next-hop 203.0.113.1
All other traffic → the regular routing table

Typical Scenarios

Scenario 1: Multi-homing (Two ISPs)

VLAN 10 through ISP1, VLAN 20 through ISP2:

# WAN interfaces
set interfaces ethernet eth0 address 203.0.113.1/30
set interfaces ethernet eth0 description 'ISP1'

set interfaces ethernet eth2 address 198.51.100.1/30
set interfaces ethernet eth2 description 'ISP2'

# LAN VLANs
set interfaces ethernet eth1 vif 10 address 192.168.10.1/24
set interfaces ethernet eth1 vif 20 address 192.168.20.1/24

# Policy route for VLAN 10 → ISP1
set policy route ISP1-ROUTE rule 10 source address 192.168.10.0/24
set policy route ISP1-ROUTE rule 10 set next-hop 203.0.113.2

# Policy route for VLAN 20 → ISP2
set policy route ISP2-ROUTE rule 10 source address 192.168.20.0/24
set policy route ISP2-ROUTE rule 10 set next-hop 198.51.100.2

set interfaces ethernet eth1 vif 10 policy route ISP1-ROUTE
set interfaces ethernet eth1 vif 20 policy route ISP2-ROUTE

# Default route and NAT
set protocols static route 0.0.0.0/0 next-hop 203.0.113.2

set nat source rule 100 outbound-interface name eth0
set nat source rule 100 translation address masquerade

set nat source rule 200 outbound-interface name eth2
set nat source rule 200 translation address masquerade

commit
save

Scenario 2: Protocol-based Routing

HTTP/HTTPS through ISP1, everything else through ISP2:

# HTTP/HTTPS through ISP1
set policy route WEB-TRAFFIC rule 10 protocol tcp
set policy route WEB-TRAFFIC rule 10 destination port 80,443
set policy route WEB-TRAFFIC rule 10 set next-hop 203.0.113.2

# Remaining traffic through ISP2
set policy route WEB-TRAFFIC rule 20 set next-hop 198.51.100.2

set interfaces ethernet eth1 policy route WEB-TRAFFIC

commit

Scenario 3: Application-based Routing

VoIP through a dedicated ISP:

# VoIP through ISP1
set policy route APP-ROUTE rule 10 protocol udp
set policy route APP-ROUTE rule 10 destination port 5060-5061,10000-20000
set policy route APP-ROUTE rule 10 set next-hop 203.0.113.2

# Video through ISP2
set policy route APP-ROUTE rule 20 protocol tcp
set policy route APP-ROUTE rule 20 destination port 1935,8080
set policy route APP-ROUTE rule 20 set next-hop 198.51.100.2

# Default
set policy route APP-ROUTE rule 999 set next-hop 203.0.113.2

set interfaces ethernet eth1 policy route APP-ROUTE

commit

Advanced Configurations

Multiple Routing Tables

# Policy route in table 100
set policy route ISP2-TABLE rule 10 source address 192.168.20.0/24
set policy route ISP2-TABLE rule 10 set table 100

# Static route in table 100
set protocols static table 100 route 0.0.0.0/0 next-hop 198.51.100.2

set interfaces ethernet eth1 vif 20 policy route ISP2-TABLE

commit

PBR with DSCP Marking

Marking VoIP traffic:

# VoIP with DSCP marking
set policy route VOIP-ROUTE rule 10 protocol udp
set policy route VOIP-ROUTE rule 10 destination port 5060-5061,10000-20000
set policy route VOIP-ROUTE rule 10 set next-hop 203.0.113.2
set policy route VOIP-ROUTE rule 10 set dscp ef

set interfaces ethernet eth1 policy route VOIP-ROUTE

commit

Integration with Cloud Platforms

Yandex Cloud

Multi-homing with a Yandex Cloud NAT Gateway:

# Primary through Yandex Cloud NAT Gateway
set interfaces ethernet eth0 address 10.0.1.10/24
set interfaces ethernet eth0 description 'Yandex Cloud NAT Gateway'

# Secondary through Elastic IP
set interfaces ethernet eth1 address 10.0.2.10/24
set interfaces ethernet eth1 description 'Elastic IP'

# LAN VLANs
set interfaces ethernet eth2 vif 10 address 192.168.10.1/24
set interfaces ethernet eth2 vif 20 address 192.168.20.1/24

# Production through NAT Gateway
set policy route YC-ROUTING rule 10 source address 192.168.10.0/24
set policy route YC-ROUTING rule 10 set next-hop 10.0.1.1

# Management through Elastic IP
set policy route YC-ROUTING rule 20 source address 192.168.20.0/24
set policy route YC-ROUTING rule 20 set next-hop 10.0.2.1

set interfaces ethernet eth2 vif 10 policy route YC-ROUTING
set interfaces ethernet eth2 vif 20 policy route YC-ROUTING

commit

PBR for Yandex Cloud services:

# Direct routing to Yandex Object Storage
set policy route YC-SERVICES rule 10 destination address 213.180.193.0/24
set policy route YC-SERVICES rule 10 set next-hop 10.0.1.1

# Yandex Monitoring
set policy route YC-SERVICES rule 20 destination address 100.64.0.0/10
set policy route YC-SERVICES rule 20 set next-hop 10.0.1.1

# Other traffic through Elastic IP
set policy route YC-SERVICES rule 999 set next-hop 10.0.2.1

set interfaces ethernet eth2 policy route YC-SERVICES

commit

Split tunneling for Yandex Cloud VPN:

# Internal networks through the VPN
set policy route YC-VPN rule 10 destination address 10.0.0.0/8
set policy route YC-VPN rule 10 set interface wg0

# Internet through the direct link
set policy route YC-VPN rule 20 set next-hop 10.0.1.1

set interfaces ethernet eth2 policy route YC-VPN

commit

VK Cloud

Multi-homing in VK Cloud:

# Primary through VK Cloud NAT
set interfaces ethernet eth0 address 10.0.1.10/24
set interfaces ethernet eth0 description 'VK Cloud Primary'

# Backup through Floating IP
set interfaces ethernet eth1 address 10.0.2.10/24
set interfaces ethernet eth1 description 'VK Cloud Backup'

set interfaces ethernet eth2 address 192.168.1.1/24

# Critical through Primary
set policy route VK-CRITICAL rule 10 source address 192.168.1.0/25
set policy route VK-CRITICAL rule 10 set next-hop 10.0.1.1

# Non-critical through Backup
set policy route VK-CRITICAL rule 20 source address 192.168.1.128/25
set policy route VK-CRITICAL rule 20 set next-hop 10.0.2.1

set interfaces ethernet eth2 policy route VK-CRITICAL

commit

PBR for the VK Cloud metadata service:

# Metadata service routing
set policy route VK-META rule 10 destination address 169.254.169.254/32
set policy route VK-META rule 10 set next-hop 10.0.1.1

# Normal internet
set policy route VK-META rule 999 action permit

set interfaces ethernet eth2 policy route VK-META

commit

Monitoring and Diagnostics

Checking Policy Routes

# List all policy routes
show policy route

# Route map details
show policy route POLICY-1

# Interface assignments
show interfaces

Testing PBR

# Traceroute with a source address
traceroute 8.8.8.8 source-address 192.168.10.10

# Ping with a source address
ping 8.8.8.8 source-address 192.168.10.10

Debugging

# Routing tables
show ip route

# Specific table
show ip route table 100

# Traffic capture
sudo tcpdump -i eth0 -n src 192.168.10.10

Troubleshooting

PBR Not Working

Diagnostics:

# Check the assignment
show interfaces ethernet eth1

# Check the policy
show policy route POLICY-1

# Traceroute
traceroute 8.8.8.8 source-address 192.168.10.10

Solution:

# Apply the policy
set interfaces ethernet eth1 policy route POLICY-1
commit

Asymmetric Routing

Solution:

# Firewall for established connections
set firewall ipv4 forward filter rule 10 action accept
set firewall ipv4 forward filter rule 10 state established
set firewall ipv4 forward filter rule 10 state related

commit

Best Practices

Planning - document your policy routes
Rule numbering - use increments of 10 (10, 20, 30…)
Testing - test with traceroute/ping
Failover - use the routing table as a fallback
NAT - configure NAT for all outbound interfaces
Performance - minimize the number of rules
Descriptions - add descriptions to rules
Backup - back up the configuration regularly
Avoid loops - plan next-hops carefully

Additional Resources

Access List Policy

Access lists filter traffic by IP address for use in routing protocols and other policies.

Basic Access List

# Permit specific network
set policy access-list 10 rule 10 action permit
set policy access-list 10 rule 10 source address 192.168.1.0/24

# Deny specific host
set policy access-list 10 rule 20 action deny
set policy access-list 10 rule 20 source address 192.168.1.50/32

# Permit all other
set policy access-list 10 rule 999 action permit
set policy access-list 10 rule 999 source address any

commit

Applying to BGP

set protocols bgp neighbor 10.0.0.1 address-family ipv4-unicast filter-list export 10
commit

Prefix List Policy

Prefix lists filter routes by IP prefix, with the ability to match on prefix length.

Basic Prefix List

# Permit /24 networks from 10.0.0.0/8
set policy prefix-list LOCAL-NETS rule 10 action permit
set policy prefix-list LOCAL-NETS rule 10 prefix 10.0.0.0/8
set policy prefix-list LOCAL-NETS rule 10 le 24

# Deny default route
set policy prefix-list NO-DEFAULT rule 20 action deny
set policy prefix-list NO-DEFAULT rule 20 prefix 0.0.0.0/0

commit

Operators:

le (less-equal) - maximum prefix length
ge (greater-equal) - minimum prefix length

Example: BGP Filter

# Prefix list
set policy prefix-list CUSTOMER-IN rule 10 action permit
set policy prefix-list CUSTOMER-IN rule 10 prefix 203.0.113.0/24

# Apply to the BGP neighbor
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast prefix-list import CUSTOMER-IN

commit

Route Map Policy

Route maps are a powerful tool for modifying route attributes (metric, preference, community, etc.).

Basic Route Map

# Match and set
set policy route-map RM-IN rule 10 action permit
set policy route-map RM-IN rule 10 match ip address prefix-list LOCAL-NETS
set policy route-map RM-IN rule 10 set local-preference 200

# Deny everything else
set policy route-map RM-IN rule 999 action deny

commit

Modifying BGP Attributes

# Route map to change the MED
set policy route-map SET-MED rule 10 action permit
set policy route-map SET-MED rule 10 match ip address prefix-list CUSTOMER-NETS
set policy route-map SET-MED rule 10 set metric 100

# AS-PATH prepend
set policy route-map PREPEND rule 10 action permit
set policy route-map PREPEND rule 10 set as-path prepend '65000 65000'

# Apply to BGP
set protocols bgp neighbor 10.0.0.1 address-family ipv4-unicast route-map import SET-MED
set protocols bgp neighbor 10.0.0.2 address-family ipv4-unicast route-map export PREPEND

commit

Match Conditions

A route map supports multiple match conditions:

# Match prefix list
set policy route-map RM rule 10 match ip address prefix-list MY-LIST

# Match AS-PATH
set policy route-map RM rule 20 match as-path AS-PATH-LIST

# Match community
set policy route-map RM rule 30 match community COMM-LIST

# Match metric
set policy route-map RM rule 40 match metric 100

# Match interface
set policy route-map RM rule 50 match interface eth0

commit

Set Actions

# Set local preference
set policy route-map RM rule 10 set local-preference 200

# Set metric (MED)
set policy route-map RM rule 10 set metric 50

# Set next-hop
set policy route-map RM rule 10 set ip-next-hop 10.0.0.1

# Set community
set policy route-map RM rule 10 set community '65000:100'

# Set AS-PATH prepend
set policy route-map RM rule 10 set as-path prepend '65000'

# Set weight
set policy route-map RM rule 10 set weight 100

commit

AS Path Policy

AS path lists filter BGP routes based on the AS PATH attribute.

AS Path Access List

# Match specific AS
set policy as-path-list FROM-AS65001 rule 10 action permit
set policy as-path-list FROM-AS65001 rule 10 regex '_65001_'

# Match transit through an AS
set policy as-path-list VIA-AS65002 rule 10 action permit
set policy as-path-list VIA-AS65002 rule 10 regex '_65002_'

# Match origin AS
set policy as-path-list ORIGIN-AS65003 rule 10 action permit
set policy as-path-list ORIGIN-AS65003 rule 10 regex '_65003$'

commit

Regex Patterns

Regex examples:

^65000_ - starts with AS 65000
_65000$ - ends with AS 65000 (origin AS)
_65000_ - contains AS 65000 (transit)
^65000$ - AS 65000 only (direct peer)
^$ - empty AS-PATH (local networks)

Applying

# Route map with an AS-PATH filter
set policy route-map FILTER-AS rule 10 action deny
set policy route-map FILTER-AS rule 10 match as-path FROM-AS65001

set policy route-map FILTER-AS rule 999 action permit

# Apply to BGP
set protocols bgp neighbor 10.0.0.1 address-family ipv4-unicast route-map import FILTER-AS

commit

Community List Policy

BGP communities for tagging and filtering routes.

Standard Community List

# Match standard community
set policy community-list COMM-100 rule 10 action permit
set policy community-list COMM-100 rule 10 regex '65000:100'

commit

Expanded Community List

# Match expanded community (regex)
set policy community-list-expanded COMM-EXP rule 10 action permit
set policy community-list-expanded COMM-EXP rule 10 regex '65000:[0-9]+'

commit

Well-Known Communities

# NO_EXPORT community
set policy route-map SET-NO-EXPORT rule 10 action permit
set policy route-map SET-NO-EXPORT rule 10 set community 'no-export'

# NO_ADVERTISE community
set policy route-map SET-NO-ADV rule 10 action permit
set policy route-map SET-NO-ADV rule 10 set community 'no-advertise'

commit

Applying Communities

# Set community
set policy route-map TAG rule 10 action permit
set policy route-map TAG rule 10 match ip address prefix-list CUSTOMER-NETS
set policy route-map TAG rule 10 set community '65000:100'

# Apply to BGP export
set protocols bgp neighbor 10.0.0.1 address-family ipv4-unicast route-map export TAG

# Filter based on community
set policy route-map FILTER-COMM rule 10 action permit
set policy route-map FILTER-COMM rule 10 match community COMM-100

set protocols bgp neighbor 10.0.0.2 address-family ipv4-unicast route-map import FILTER-COMM

commit

Large Community List Policy

Large communities (RFC 8092) for extended tagging.

Large Community List

# Format: Global-Admin:Local-Data-Part-1:Local-Data-Part-2
set policy large-community-list LC-LIST rule 10 action permit
set policy large-community-list LC-LIST rule 10 regex '65000:100:1'

commit

Applying

# Set large community
set policy route-map SET-LC rule 10 action permit
set policy route-map SET-LC rule 10 set large-community '65000:100:1'

# Match large community
set policy route-map MATCH-LC rule 10 action permit
set policy route-map MATCH-LC rule 10 match large-community LC-LIST

commit

Extended Community List Policy

Extended communities for MPLS VPN and other advanced scenarios.

Extended Community List

# Route Target
set policy extcommunity-list RT-65000-100 rule 10 action permit
set policy extcommunity-list RT-65000-100 rule 10 regex 'RT:65000:100'

# Site of Origin
set policy extcommunity-list SOO-65000-1 rule 10 action permit
set policy extcommunity-list SOO-65000-1 rule 10 regex 'SoO:65000:1'

commit

Local Route Policy

Local route policy for filtering local route announcements.

Basic Configuration

# Policy for local routes
set policy local-route rule 10 action permit
set policy local-route rule 10 source 10.0.0.0/8

set policy local-route rule 999 action deny

commit

Comprehensive Example: ISP with BGP

# === PREFIX LISTS ===
# Customer prefixes
set policy prefix-list CUSTOMER rule 10 action permit
set policy prefix-list CUSTOMER rule 10 prefix 203.0.113.0/24

# Upstream transit
set policy prefix-list UPSTREAM rule 10 action permit
set policy prefix-list UPSTREAM rule 10 prefix 0.0.0.0/0
set policy prefix-list UPSTREAM rule 10 le 32

# === AS-PATH LISTS ===
# Filter customer AS
set policy as-path-list FROM-CUSTOMER rule 10 action permit
set policy as-path-list FROM-CUSTOMER rule 10 regex '^65001_'

# === COMMUNITY LISTS ===
# Tag customer routes
set policy community-list CUST-TAG rule 10 action permit
set policy community-list CUST-TAG rule 10 regex '65000:100'

# === ROUTE MAPS ===
# Customer import
set policy route-map CUST-IN rule 10 action permit
set policy route-map CUST-IN rule 10 match ip address prefix-list CUSTOMER
set policy route-map CUST-IN rule 10 match as-path FROM-CUSTOMER
set policy route-map CUST-IN rule 10 set local-preference 200
set policy route-map CUST-IN rule 10 set community '65000:100'

# Customer export
set policy route-map CUST-OUT rule 10 action permit
set policy route-map CUST-OUT rule 10 match community CUST-TAG
set policy route-map CUST-OUT rule 10 set as-path prepend '65000'

# Upstream import
set policy route-map UP-IN rule 10 action permit
set policy route-map UP-IN rule 10 match ip address prefix-list UPSTREAM
set policy route-map UP-IN rule 10 set local-preference 100

# Upstream export - customer prefixes only
set policy route-map UP-OUT rule 10 action permit
set policy route-map UP-OUT rule 10 match ip address prefix-list CUSTOMER

set policy route-map UP-OUT rule 999 action deny

# === BGP ===
set protocols bgp system-as 65000

# Customer
set protocols bgp neighbor 203.0.113.1 remote-as 65001
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import CUST-IN
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map export CUST-OUT

# Upstream
set protocols bgp neighbor 198.51.100.1 remote-as 174
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast route-map import UP-IN
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast route-map export UP-OUT

commit
save

Next Steps

QoS - integration with QoS
Load Balancing - combining with WAN LB
VRF - routing table isolation
Firewall - protecting PBR traffic
BGP - advanced BGP policies

Reviewed by OpenNix LLC · Last updated on 29 July 2026