Static Routing (Static Routes)

Static routes are routes configured manually by an administrator that do not change automatically when the network topology changes.

Overview

Static routing is used when:

The network topology is simple
Routes are predictable
Resource requirements are minimal
Full control over routing is required
There is no need for automatic adaptation

Advantages:

Simple configuration
Predictable behavior
No routing protocol overhead
Full control
Security (no dynamic exchange)

Disadvantages:

Manual management
No automatic failover
Does not scale for large networks
Requires manual updates when things change

IPv4 static routes

Basic route

A route with a next-hop address:

set protocols static route 192.168.2.0/24 next-hop 10.0.0.2
commit

Syntax:

set protocols static route <network/prefix> next-hop <IP-address>

Route via interface

When the next-hop is in a directly connected network:

set protocols static route 192.168.3.0/24 interface eth1
commit

Useful for point-to-point links.

Default route

Default gateway (0.0.0.0/0):

set protocols static route 0.0.0.0/0 next-hop 192.0.2.1
commit

All traffic that does not match any other route will go through this next-hop.

Multiple next-hops

Load balancing across multiple paths:

set protocols static route 192.168.10.0/24 next-hop 10.0.0.2
set protocols static route 192.168.10.0/24 next-hop 10.0.0.3
commit

Traffic will be distributed between both next-hops (ECMP - Equal-Cost Multi-Path).

Administrative Distance

The priority of a route when the same network is learned from multiple sources.

Setting the distance

set protocols static route 192.168.5.0/24 next-hop 10.0.0.2 distance 10
commit

Values:

1 - default for static routes
1-255 - valid range
255 - route disabled

Floating Static Route

A backup route with a higher distance:

# Primary route (via OSPF, AD=110)
set protocols ospf ...

# Backup static route
set protocols static route 192.168.20.0/24 next-hop 10.0.0.10 distance 120
commit

The static route is activated only if the OSPF route disappears.

Blackhole Routes

Routes that silently drop packets (no ICMP).

set protocols static route 192.168.100.0/24 blackhole
commit

Used for:

Preventing routing loops
Security (blocking unwanted traffic)
Route aggregation

Blackhole with distance

set protocols static route 10.0.0.0/8 blackhole distance 200
commit

Reject Routes

Routes that reject packets by sending an ICMP unreachable message.

set protocols static route 172.16.0.0/12 reject
commit

Difference from blackhole:

blackhole - drops silently (no ICMP)
reject - sends ICMP destination unreachable

BFD Support

Bidirectional Forwarding Detection for fast detection of next-hop failures.

Enabling BFD

set protocols static route 192.168.30.0/24 next-hop 10.0.0.5 bfd
commit

The BFD session monitors next-hop reachability and automatically removes the route on failure.

Configuring a BFD profile

set protocols bfd profile static-routes interval transmit 300
set protocols bfd profile static-routes interval receive 300
set protocols bfd profile static-routes interval multiplier 3

set protocols static route 192.168.40.0/24 next-hop 10.0.0.6 bfd profile static-routes
commit

BFD parameters:

transmit - transmit interval (ms)
receive - receive interval (ms)
multiplier - number of missed packets before declaring the session down

Disable Route

Temporarily disabling a route without removing its configuration:

set protocols static route 192.168.50.0/24 next-hop 10.0.0.7 disable
commit

IPv6 static routes

Basic IPv6 route

set protocols static route6 2001:db8:2::/64 next-hop 2001:db8:1::2
commit

IPv6 route via interface

set protocols static route6 2001:db8:3::/64 interface eth1
commit

IPv6 default route

set protocols static route6 ::/0 next-hop 2001:db8:1::1
commit

IPv6 blackhole

set protocols static route6 2001:db8:100::/48 blackhole
commit

Routing Tables and VRF

Static routes in alternative routing tables (VRF).

Route in a VRF

set vrf name MGMT table 100
set protocols static route 192.168.99.0/24 interface eth2 vrf MGMT
commit

Verifying routes in a VRF

show ip route vrf MGMT

Configuration examples

Simple network with two locations

Topology:

[Site A] ---- 10.0.0.0/30 ---- [Site B]
192.168.1.0/24             192.168.2.0/24

Site A configuration:

set protocols static route 192.168.2.0/24 next-hop 10.0.0.2
commit

Site B configuration:

set protocols static route 192.168.1.0/24 next-hop 10.0.0.1
commit

Default route to an ISP

set protocols static route 0.0.0.0/0 next-hop 203.0.113.1
set protocols static route 0.0.0.0/0 description 'Default route to ISP'
commit

Dual ISP with failover

Topology:

        ISP1 (primary)
         |
      VyOS Router
         |
        ISP2 (backup)

Configuration:

# Primary ISP (lower distance)
set protocols static route 0.0.0.0/0 next-hop 198.51.100.1 distance 10

# Backup ISP (higher distance)
set protocols static route 0.0.0.0/0 next-hop 203.0.113.1 distance 20

commit

The backup route is activated only when the primary is unavailable.

Load balancing across two links

set protocols static route 0.0.0.0/0 next-hop 198.51.100.1
set protocols static route 0.0.0.0/0 next-hop 203.0.113.1
commit

Traffic is distributed between both next-hops (ECMP).

Blackhole for security

Blocking access to the internal management network from the DMZ:

set protocols static route 192.168.99.0/24 blackhole
commit

VPN site-to-site routes

After setting up a VPN tunnel (for example, WireGuard):

set protocols static route 192.168.10.0/24 interface wg0
set protocols static route 192.168.20.0/24 interface wg0
commit

Aggregate route with blackhole

Advertise an aggregated prefix, using a blackhole for non-existent subnets:

# Aggregate
set protocols static route 10.0.0.0/16 blackhole distance 200

# Specific subnets
set protocols static route 10.0.1.0/24 next-hop 10.1.1.1
set protocols static route 10.0.2.0/24 next-hop 10.1.1.2

commit

A blackhole with a high distance is not activated as long as more specific routes exist.

Multi-site hub-and-spoke

Hub configuration:

# Routes to spokes
set protocols static route 192.168.10.0/24 next-hop 10.10.0.10
set protocols static route 192.168.20.0/24 next-hop 10.10.0.20
set protocols static route 192.168.30.0/24 next-hop 10.10.0.30
commit

Spoke configuration (for example, Spoke1):

# Default to hub
set protocols static route 0.0.0.0/0 next-hop 10.10.0.1

# Specific routes to other spokes (optional)
set protocols static route 192.168.20.0/24 next-hop 10.10.0.1
set protocols static route 192.168.30.0/24 next-hop 10.10.0.1
commit

Operational commands

Viewing the routing table

All routes:

show ip route

Static routes only:

show ip route static

A specific network:

show ip route 192.168.1.0/24

IPv6:

show ipv6 route
show ipv6 route static

Route details

show ip route 192.168.1.0/24 detail

Statistics

show ip route summary

Connectivity check

ping 192.168.2.1
traceroute 192.168.2.1

Ping with a source-address:

ping 192.168.2.1 source-address 192.168.1.1

Troubleshooting

Route does not appear in the table

Check the configuration:

show configuration commands | grep static

Check next-hop reachability:

ping <next-hop-IP>

Check interface status:

show interfaces

Traffic does not pass

Check the route:

show ip route <destination>

Traceroute:

traceroute <destination>

Check the firewall:

show firewall

Check NAT (if applicable):

show nat source rules

ECMP does not balance

Make sure both next-hops have the same distance:

show ip route static

Verify that both paths are active:

show ip route <network> detail

Floating route does not activate

Check the distance:

show ip route <network> detail

Make sure the floating route’s distance is higher than that of the primary route.

Integration with dynamic protocols

Redistribute static into OSPF

set protocols ospf redistribute static
commit

Redistribute static into BGP

set protocols bgp system-as 65001
set protocols bgp redistribute static
commit

Route-map for selective redistribution

set policy route-map STATIC-TO-OSPF rule 10 action permit
set policy route-map STATIC-TO-OSPF rule 10 match ip address prefix-list ALLOWED-PREFIXES

set protocols ospf redistribute static route-map STATIC-TO-OSPF
commit

Best practices

Document your routes - use description
Use distance - for failover scenarios
Plan IP addressing - prefix summarization
Test failover - verify backup routes
Monitoring - track next-hop status
BFD - for fast failure detection
Backup - save your configuration
Avoid loops - check route symmetry
Route aggregation - use blackhole routes
Logging - document changes

When to use static routes

Suitable for:

Small networks (< 5 routers)
Stub networks (a single exit only)
Default routes
Host routes
VPN site-to-site
Lab/test environments

Not suitable for:

Large networks (> 10 routers)
Frequent topology changes
Automatic failover requirements
Mesh topologies
When fast convergence is needed

Migrating to dynamic routing

As the network grows, a transition to dynamic routing may be required.

Gradual migration

Run a dynamic protocol in parallel
Use distance to control preferences
Gradually remove the static routes
Test at each stage

Hybrid approach

A combination of static and dynamic routes:

Static for stub sites
Dynamic (OSPF/BGP) for the core
Redistribute static into the dynamic protocol

Next steps

OSPF - for automatic routing in the enterprise
BGP - for connecting to an ISP
VRF - routing table isolation
BFD - fast failure detection

Reviewed by OpenNix LLC · Last updated on 29 July 2026

Routing in VyOS BGP (Border Gateway Protocol)