# Static Routing (Static Routes)

> Configure static routes on VyOS: static routes, blackhole routes, floating routes, and load balancing for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/routing/vyos-static/


Static routes are routes configured manually by an administrator that do not change automatically when the network topology changes.

## Overview

Static routing is used when:
- The network topology is simple
- Routes are predictable
- Resource requirements are minimal
- Full control over routing is required
- There is no need for automatic adaptation

**Advantages**:
- Simple configuration
- Predictable behavior
- No routing protocol overhead
- Full control
- Security (no dynamic exchange)

**Disadvantages**:
- Manual management
- No automatic failover
- Does not scale for large networks
- Requires manual updates when things change

## IPv4 static routes

### Basic route

A route with a next-hop address:

```
set protocols static route 192.168.2.0/24 next-hop 10.0.0.2
commit
```

Syntax:
```
set protocols static route <network/prefix> next-hop <IP-address>
```

### Route via interface

When the next-hop is in a directly connected network:

```
set protocols static route 192.168.3.0/24 interface eth1
commit
```

Useful for point-to-point links.

### Default route

Default gateway (0.0.0.0/0):

```
set protocols static route 0.0.0.0/0 next-hop 192.0.2.1
commit
```

All traffic that does not match any other route will go through this next-hop.

### Multiple next-hops

Load balancing across multiple paths:

```
set protocols static route 192.168.10.0/24 next-hop 10.0.0.2
set protocols static route 192.168.10.0/24 next-hop 10.0.0.3
commit
```

Traffic will be distributed between both next-hops (ECMP - Equal-Cost Multi-Path).

## Administrative Distance

The priority of a route when the same network is learned from multiple sources.

### Setting the distance

```
set protocols static route 192.168.5.0/24 next-hop 10.0.0.2 distance 10
commit
```

Values:
- **1** - default for static routes
- **1-255** - valid range
- **255** - route disabled

### Floating Static Route

A backup route with a higher distance:

```
# Primary route (via OSPF, AD=110)
set protocols ospf ...

# Backup static route
set protocols static route 192.168.20.0/24 next-hop 10.0.0.10 distance 120
commit
```

The static route is activated only if the OSPF route disappears.

## Blackhole Routes

Routes that silently drop packets (no ICMP).

```
set protocols static route 192.168.100.0/24 blackhole
commit
```

Used for:
- Preventing routing loops
- Security (blocking unwanted traffic)
- Route aggregation

### Blackhole with distance

```
set protocols static route 10.0.0.0/8 blackhole distance 200
commit
```

## Reject Routes

Routes that reject packets by sending an ICMP unreachable message.

```
set protocols static route 172.16.0.0/12 reject
commit
```

Difference from blackhole:
- **blackhole** - drops silently (no ICMP)
- **reject** - sends ICMP destination unreachable

## BFD Support

Bidirectional Forwarding Detection for fast detection of next-hop failures.

### Enabling BFD

```
set protocols static route 192.168.30.0/24 next-hop 10.0.0.5 bfd
commit
```

The BFD session monitors next-hop reachability and automatically removes the route on failure.

### Configuring a BFD profile

```
set protocols bfd profile static-routes interval transmit 300
set protocols bfd profile static-routes interval receive 300
set protocols bfd profile static-routes interval multiplier 3

set protocols static route 192.168.40.0/24 next-hop 10.0.0.6 bfd profile static-routes
commit
```

BFD parameters:
- **transmit** - transmit interval (ms)
- **receive** - receive interval (ms)
- **multiplier** - number of missed packets before declaring the session down

## Disable Route

Temporarily disabling a route without removing its configuration:

```
set protocols static route 192.168.50.0/24 next-hop 10.0.0.7 disable
commit
```

## IPv6 static routes

### Basic IPv6 route

```
set protocols static route6 2001:db8:2::/64 next-hop 2001:db8:1::2
commit
```

### IPv6 route via interface

```
set protocols static route6 2001:db8:3::/64 interface eth1
commit
```

### IPv6 default route

```
set protocols static route6 ::/0 next-hop 2001:db8:1::1
commit
```

### IPv6 blackhole

```
set protocols static route6 2001:db8:100::/48 blackhole
commit
```

## Routing Tables and VRF

Static routes in alternative routing tables (VRF).

### Route in a VRF

```
set vrf name MGMT table 100
set protocols static route 192.168.99.0/24 interface eth2 vrf MGMT
commit
```

### Verifying routes in a VRF

```
show ip route vrf MGMT
```

## Configuration examples

### Simple network with two locations

**Topology**:
```
[Site A] ---- 10.0.0.0/30 ---- [Site B]
192.168.1.0/24             192.168.2.0/24
```

**Site A configuration**:
```
set protocols static route 192.168.2.0/24 next-hop 10.0.0.2
commit
```

**Site B configuration**:
```
set protocols static route 192.168.1.0/24 next-hop 10.0.0.1
commit
```

### Default route to an ISP

```
set protocols static route 0.0.0.0/0 next-hop 203.0.113.1
set protocols static route 0.0.0.0/0 description 'Default route to ISP'
commit
```

### Dual ISP with failover

**Topology**:
```
        ISP1 (primary)
         |
      VyOS Router
         |
        ISP2 (backup)
```

**Configuration**:
```
# Primary ISP (lower distance)
set protocols static route 0.0.0.0/0 next-hop 198.51.100.1 distance 10

# Backup ISP (higher distance)
set protocols static route 0.0.0.0/0 next-hop 203.0.113.1 distance 20

commit
```

The backup route is activated only when the primary is unavailable.

### Load balancing across two links

```
set protocols static route 0.0.0.0/0 next-hop 198.51.100.1
set protocols static route 0.0.0.0/0 next-hop 203.0.113.1
commit
```

Traffic is distributed between both next-hops (ECMP).

### Blackhole for security

Blocking access to the internal management network from the DMZ:

```
set protocols static route 192.168.99.0/24 blackhole
commit
```

### VPN site-to-site routes

After setting up a VPN tunnel (for example, WireGuard):

```
set protocols static route 192.168.10.0/24 interface wg0
set protocols static route 192.168.20.0/24 interface wg0
commit
```

### Aggregate route with blackhole

Advertise an aggregated prefix, using a blackhole for non-existent subnets:

```
# Aggregate
set protocols static route 10.0.0.0/16 blackhole distance 200

# Specific subnets
set protocols static route 10.0.1.0/24 next-hop 10.1.1.1
set protocols static route 10.0.2.0/24 next-hop 10.1.1.2

commit
```

A blackhole with a high distance is not activated as long as more specific routes exist.

### Multi-site hub-and-spoke

**Hub configuration**:
```
# Routes to spokes
set protocols static route 192.168.10.0/24 next-hop 10.10.0.10
set protocols static route 192.168.20.0/24 next-hop 10.10.0.20
set protocols static route 192.168.30.0/24 next-hop 10.10.0.30
commit
```

**Spoke configuration** (for example, Spoke1):
```
# Default to hub
set protocols static route 0.0.0.0/0 next-hop 10.10.0.1

# Specific routes to other spokes (optional)
set protocols static route 192.168.20.0/24 next-hop 10.10.0.1
set protocols static route 192.168.30.0/24 next-hop 10.10.0.1
commit
```

## Operational commands

### Viewing the routing table

All routes:
```
show ip route
```

Static routes only:
```
show ip route static
```

A specific network:
```
show ip route 192.168.1.0/24
```

IPv6:
```
show ipv6 route
show ipv6 route static
```

### Route details

```
show ip route 192.168.1.0/24 detail
```

### Statistics

```
show ip route summary
```

### Connectivity check

```
ping 192.168.2.1
traceroute 192.168.2.1
```

Ping with a source-address:
```
ping 192.168.2.1 source-address 192.168.1.1
```

## Troubleshooting

### Route does not appear in the table

Check the configuration:
```
show configuration commands | grep static
```

Check next-hop reachability:
```
ping <next-hop-IP>
```

Check interface status:
```
show interfaces
```

### Traffic does not pass

Check the route:
```
show ip route <destination>
```

Traceroute:
```
traceroute <destination>
```

Check the firewall:
```
show firewall
```

Check NAT (if applicable):
```
show nat source rules
```

### ECMP does not balance

Make sure both next-hops have the same distance:
```
show ip route static
```

Verify that both paths are active:
```
show ip route <network> detail
```

### Floating route does not activate

Check the distance:
```
show ip route <network> detail
```

Make sure the floating route's distance is higher than that of the primary route.

## Integration with dynamic protocols

### Redistribute static into OSPF

```
set protocols ospf redistribute static
commit
```

### Redistribute static into BGP

```
set protocols bgp system-as 65001
set protocols bgp redistribute static
commit
```

### Route-map for selective redistribution

```
set policy route-map STATIC-TO-OSPF rule 10 action permit
set policy route-map STATIC-TO-OSPF rule 10 match ip address prefix-list ALLOWED-PREFIXES

set protocols ospf redistribute static route-map STATIC-TO-OSPF
commit
```

## Best practices

1. **Document your routes** - use description
2. **Use distance** - for failover scenarios
3. **Plan IP addressing** - prefix summarization
4. **Test failover** - verify backup routes
5. **Monitoring** - track next-hop status
6. **BFD** - for fast failure detection
7. **Backup** - save your configuration
8. **Avoid loops** - check route symmetry
9. **Route aggregation** - use blackhole routes
10. **Logging** - document changes

## When to use static routes

**Suitable for**:
- Small networks (< 5 routers)
- Stub networks (a single exit only)
- Default routes
- Host routes
- VPN site-to-site
- Lab/test environments

**Not suitable for**:
- Large networks (> 10 routers)
- Frequent topology changes
- Automatic failover requirements
- Mesh topologies
- When fast convergence is needed

## Migrating to dynamic routing

As the network grows, a transition to dynamic routing may be required.

### Gradual migration

1. Run a dynamic protocol in parallel
2. Use distance to control preferences
3. Gradually remove the static routes
4. Test at each stage

### Hybrid approach

A combination of static and dynamic routes:
- **Static** for stub sites
- **Dynamic** (OSPF/BGP) for the core
- Redistribute static into the dynamic protocol

## Next steps

- [OSPF](/docs/vyos/routing/vyos-ospf/) - for automatic routing in the enterprise
- [BGP](/docs/vyos/routing/vyos-bgp/) - for connecting to an ISP
- [VRF](/docs/vyos/vrf/) - routing table isolation
- [BFD](/docs/vyos/routing/vyos-bfd/) - fast failure detection