Default Route in VyOS

The default route (default route, default gateway) is a routing entry that determines where packets should be sent when no more specific route is found in the routing table. In VyOS, the default route is configured through static routes and is a critically important element of the network configuration.

Core concepts

What is a default route

A default route is a route to the network with the prefix 0.0.0.0/0 for IPv4 or ::/0 for IPv6. These prefixes cover every possible IP address but have the lowest specificity (the longest network mask).

How it works:

The router looks for the most specific (longest prefix match) route for a packet
If no specific route is found, the default route is used
The default gateway is the next-hop address in the default route

Use cases:

Directing all traffic to external networks (the internet)
Connecting remote networks through a central router
Cloud environments (Yandex Cloud, VK Cloud, AWS, Azure)

Configuration evolution in VyOS

Legacy method (VyOS 1.1.x and earlier):

# Not used in modern versions
set system gateway-address 192.168.1.254

Modern method (VyOS 1.2+):

# The correct method via a static route
set protocols static route 0.0.0.0/0 next-hop 192.168.1.254

Important: The set system gateway-address command is no longer supported. Use only protocols static route.

Metric and administrative distance

Distance (administrative distance):

Determines the priority between routes from different sources
Default for static routes: 1
A lower value means higher priority

Distance examples:

Connected routes: 0
Static routes: 1
OSPF: 110
BGP: 200

Metric (route metric):

Used to choose between multiple routes to the same network from a single protocol
A lower value is preferred
Default for static routes: 0

IPv4 default route configuration

Basic configuration

# Simplest option - a default route via a next-hop
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1

commit
save

Verification:

show ip route 0.0.0.0

# Output:
# Routing entry for 0.0.0.0/0
#   Known via "static", distance 1, metric 0, best
#   Last update 00:05:23 ago
#   * 192.168.1.1, via eth0

Route via an interface

For point-to-point connections you can specify only the interface without a next-hop:

# Route via an interface (for PPPoE, tunnels)
set protocols static route 0.0.0.0/0 interface pppoe0

commit
save

Use cases:

PPPoE connections
GRE, IPsec tunnels
VPN connections

Configuring distance

# Route with a modified administrative distance
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1 distance 10

commit
save

Use case: A backup route with a higher distance is used only when the primary route becomes unavailable.

DHCP-learned default route

When an IP address is obtained via DHCP, VyOS automatically receives a default gateway as well:

# DHCP on the interface
set interfaces ethernet eth0 address dhcp

commit
save

Checking the DHCP-learned route:

show ip route 0.0.0.0

# The output will show:
# Known via "dhcp"

Priority: DHCP routes usually have a higher distance than static routes and will be superseded by a static route.

Deleting the default route

# Delete the default route
delete protocols static route 0.0.0.0/0

commit
save

IPv6 default route configuration

Basic IPv6 configuration

# IPv6 default route
set protocols static route6 ::/0 next-hop 2001:db8::1

commit
save

Verification:

show ipv6 route ::/0

# Output:
# Routing entry for ::/0
#   Known via "static", distance 1, metric 0, best
#   Last update 00:02:15 ago
#   * 2001:db8::1, via eth0

IPv6 via Router Advertisement

In IPv6, the default route is often obtained automatically via Router Advertisement (RA):

# Enable receiving RA on the interface
set interfaces ethernet eth0 ipv6 address autoconf

commit
save

Checking the RA-learned route:

show ipv6 route ::/0

# The output will show:
# Known via "ra" (Router Advertisement)

DHCPv6 and the default route

DHCPv6 does not distribute a default gateway (by design of the protocol). For an IPv6 default route, use:

Router Advertisement (RA)
A static route
A dynamic routing protocol (OSPFv3, BGP)

# Obtaining an address via DHCPv6
set interfaces ethernet eth0 address dhcpv6

# The default route is still required separately
set protocols static route6 ::/0 next-hop 2001:db8::1

commit
save

IPv6 via an interface

# IPv6 default route via an interface
set protocols static route6 ::/0 interface sit0

commit
save

Use case: IPv6-in-IPv4 tunnels, 6to4, 6rd.

Multiple default routes

ECMP (Equal-Cost Multi-Path)

VyOS supports load balancing traffic across several equal-cost routes:

# Two routes with the same metric
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1
set protocols static route 0.0.0.0/0 next-hop 192.168.1.2

# Enable layer4 hashing for per-session balancing
set system ip multipath layer4-hashing

commit
save

Balancing mechanism:

layer4-hashing: Uses source IP, destination IP, protocol, source port, destination port
Ensures packet ordering is preserved within a single TCP session
Distribution is per-flow, not per-packet

Verification:

show ip route 0.0.0.0

# The output will show both next-hops:
# Routing entry for 0.0.0.0/0
#   Known via "static", distance 1, metric 0, best
#   * 192.168.1.1, via eth0
#   * 192.168.1.2, via eth0

Failover via distance

To switch automatically to a backup route, use different distances:

# Primary route (distance 1)
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1 distance 1

# Backup route (distance 10)
set protocols static route 0.0.0.0/0 next-hop 192.168.2.1 distance 10

commit
save

Behavior:

The route with the lowest distance is used (192.168.1.1)
When the primary next-hop becomes unavailable, the backup (192.168.2.1) is activated
Next-hop reachability tracking is required (BFD, track)

Combining ECMP + failover

# Two primary routes with ECMP (distance 1)
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1 distance 1
set protocols static route 0.0.0.0/0 next-hop 192.168.1.2 distance 1

# Backup route (distance 10)
set protocols static route 0.0.0.0/0 next-hop 192.168.2.1 distance 10

# Balancing for the primary routes
set system ip multipath layer4-hashing

commit
save

Result:

Balancing between 192.168.1.1 and 192.168.1.2
Automatic switchover to 192.168.2.1 when both primary routes are unavailable

Routing by tables (VRF)

Default route in a VRF

VyOS supports VRF (Virtual Routing and Forwarding) to isolate routing tables:

# Create a VRF
set vrf name CUSTOMER1 table 100

# Assign an interface to the VRF
set interfaces ethernet eth2 vrf CUSTOMER1

# Default route in VRF CUSTOMER1
set vrf name CUSTOMER1 protocols static route 0.0.0.0/0 next-hop 10.0.1.1

commit
save

Verification:

# Show routes in the VRF
show ip route vrf CUSTOMER1

# Show all VRFs
show vrf

Policy-Based Routing (PBR) with a default route

PBR lets you direct traffic to specific routes based on rules:

# Create a policy route
set policy route PBR rule 10 source address 192.168.10.0/24
set policy route PBR rule 10 set table 100

# Routing table 100
set protocols static table 100 route 0.0.0.0/0 next-hop 203.0.113.1

# Apply on the interface
set interfaces ethernet eth1 policy route PBR

commit
save

Use case: Directing traffic from specific subnets through a particular ISP.

Examples for cloud providers

Yandex Cloud - default route

Scenario: VyOS in Yandex Cloud with a default route to the cloud’s virtual router.

Determining the Yandex Cloud gateway:

The gateway is always the first IP in the subnet
For the subnet 10.128.0.0/24, the gateway is 10.128.0.1

Configuration:

# Interface in the Yandex Cloud subnet
set interfaces ethernet eth0 address 10.128.0.10/24
set interfaces ethernet eth0 description 'Yandex Cloud Subnet'

# Default route to the Yandex Cloud gateway
set protocols static route 0.0.0.0/0 next-hop 10.128.0.1
set protocols static route 0.0.0.0/0 description 'Yandex Cloud default gateway'

commit
save

Verification:

# Check the route
show ip route 0.0.0.0

# Check connectivity
ping 8.8.8.8

# Trace the route
traceroute 8.8.8.8

Yandex Cloud specifics:

The virtual router is reachable at the first IP of the subnet
Only static routes are supported (no DHCP option 3 by default)
A static configuration is required

Yandex Cloud - dual-homed with failover

Scenario: VyOS with two interfaces in different subnets for fault tolerance.

# First interface (primary)
set interfaces ethernet eth0 address 10.128.0.10/24
set interfaces ethernet eth0 description 'Yandex Cloud Primary'

# Second interface (backup)
set interfaces ethernet eth1 address 10.129.0.10/24
set interfaces ethernet eth1 description 'Yandex Cloud Backup'

# Primary route via eth0 (distance 1)
set protocols static route 0.0.0.0/0 next-hop 10.128.0.1 distance 1
set protocols static route 0.0.0.0/0 description 'Primary default route'

# Backup route via eth1 (distance 10)
set protocols static route 0.0.0.0/0 next-hop 10.129.0.1 distance 10
set protocols static route 0.0.0.0/0 description 'Backup default route'

commit
save

Monitoring failover:

# Continuous route monitoring
watch -n 1 'show ip route 0.0.0.0'

# Check the logs
monitor log

VK Cloud - dual default routes with metrics

Scenario: A VK Cloud setup with two ISPs for balancing and redundancy.

# Interface to the VK Cloud router
set interfaces ethernet eth0 address 10.0.0.10/24
set interfaces ethernet eth0 description 'VK Cloud Primary'

# Second interface (backup ISP)
set interfaces ethernet eth1 address 10.0.1.10/24
set interfaces ethernet eth1 description 'VK Cloud Secondary'

# Primary default route with distance 1
set protocols static route 0.0.0.0/0 next-hop 10.0.0.1 distance 1
set protocols static route 0.0.0.0/0 description 'VK Cloud Primary ISP'

# Secondary default route with distance 20
set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 distance 20
set protocols static route 0.0.0.0/0 description 'VK Cloud Backup ISP'

# NAT for both interfaces
set nat source rule 100 outbound-interface eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

set nat source rule 110 outbound-interface eth1
set nat source rule 110 source address 192.168.1.0/24
set nat source rule 110 translation address masquerade

commit
save

ECMP option for VK Cloud:

# Two routes with the same distance for balancing
set protocols static route 0.0.0.0/0 next-hop 10.0.0.1 distance 1
set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 distance 1

# Enable layer4 hashing
set system ip multipath layer4-hashing

commit
save

Yandex Cloud - IPv6 default route

Scenario: Dual-stack in Yandex Cloud with IPv4 and IPv6 default routes.

# IPv4 address and route
set interfaces ethernet eth0 address 10.128.0.10/24
set protocols static route 0.0.0.0/0 next-hop 10.128.0.1

# IPv6 address and route
set interfaces ethernet eth0 address 2a02:6b8::/64
set protocols static route6 ::/0 next-hop 2a02:6b8::1

commit
save

Verifying dual-stack:

# IPv4
ping 8.8.8.8

# IPv6
ping6 2001:4860:4860::8888

# Show both routes
show ip route 0.0.0.0
show ipv6 route ::/0

Advanced configuration

BFD for next-hop tracking

Bidirectional Forwarding Detection (BFD) provides fast detection of next-hop failures:

# Configure a BFD profile
set protocols bfd peer 192.168.1.1 interval transmit 300
set protocols bfd peer 192.168.1.1 interval receive 300
set protocols bfd peer 192.168.1.1 interval multiplier 3

# Bind the static route to BFD
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1
set protocols static route 0.0.0.0/0 bfd

# Backup route
set protocols static route 0.0.0.0/0 next-hop 192.168.2.1 distance 10

commit
save

BFD parameters:

transmit: The interval for sending BFD packets (ms)
receive: The expected receive interval (ms)
multiplier: The number of missed packets before a failure is detected

Result: When 192.168.1.1 becomes unavailable (per BFD), the route switches automatically to the backup.

Next-hop tracking

Tracking next-hop reachability without BFD:

# Static route with next-hop reachability checking
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1
set protocols static route 0.0.0.0/0 disable-route-map

# The backup route is activated when the primary becomes unavailable
set protocols static route 0.0.0.0/0 next-hop 192.168.2.1 distance 10

commit
save

Default route with SNAT

Automatic NAT configuration for the default route:

# Default route
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1

# Source NAT for outbound traffic
set nat source rule 100 outbound-interface eth0
set nat source rule 100 source address 10.0.0.0/8
set nat source rule 100 translation address masquerade

commit
save

Use case: A typical configuration for an edge router with a private LAN.

Metric to influence route selection

# Two routes with different metrics
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1 distance 1
set protocols static route 0.0.0.0/0 metric 10

set protocols static route 0.0.0.0/0 next-hop 192.168.2.1 distance 1
set protocols static route 0.0.0.0/0 metric 20

commit
save

Note: When the distance is equal, the route with the lower metric is preferred.

Null route as the default

For special cases (blackhole routing, testing):

# Drop all traffic that has no route
set protocols static route 0.0.0.0/0 blackhole

commit
save

Use case: DDoS protection, testing, temporary network isolation.

Verification and diagnostic commands

Viewing the default route

# IPv4 default route
show ip route 0.0.0.0

# Output:
# Routing entry for 0.0.0.0/0
#   Known via "static", distance 1, metric 0, best
#   Last update 00:15:32 ago
#   * 192.168.1.1, via eth0

# IPv6 default route
show ipv6 route ::/0

# All static routes
show ip route static

# Only default routes
show ip route 0.0.0.0/0

Full routing table

# The entire IPv4 routing table
show ip route

# The entire IPv6 routing table
show ipv6 route

# JSON format for automation
show ip route json

Checking next-hop reachability

# Ping the gateway
ping 192.168.1.1

# Traceroute through the default route
traceroute 8.8.8.8

# ARP entry for the gateway (should be resolved)
show arp | grep 192.168.1.1

# IPv6 neighbor for the gateway
show ipv6 neighbors | grep 2001:db8::1

Monitoring route changes

# Real-time monitoring of the routing table
monitor protocol static

# Routing logs
show log | grep routing

# FRR logs (VyOS uses FRR for routing)
show log tail 100 | grep staticd

Checking ECMP balancing

# Show interface statistics
show interfaces ethernet eth0 statistics
show interfaces ethernet eth1 statistics

# Compare TX bytes for balancing
watch -n 1 'show interfaces ethernet eth0 statistics ; show interfaces ethernet eth1 statistics'

# Kernel routing cache (for diagnostics only)
ip route get 8.8.8.8

BFD status

# Show BFD sessions
show protocols bfd peers

# Detailed information about a BFD peer
show protocols bfd peer 192.168.1.1

# BFD statistics
show protocols bfd peer 192.168.1.1 counters

VRF routes

# Show routes in a specific VRF
show ip route vrf CUSTOMER1

# List all VRFs
show vrf

# Ping from a VRF
ping 8.8.8.8 vrf CUSTOMER1

Troubleshooting

1. The default route is not applied

Symptoms: Packets do not leave through the configured default gateway.

Checks:

# Check whether the route exists
show ip route 0.0.0.0

# Check the configuration
show configuration protocols static

# Check the FRR status
show ip protocol

Solution:

# Recreate the route
delete protocols static route 0.0.0.0/0
commit

set protocols static route 0.0.0.0/0 next-hop 192.168.1.1
commit
save

# Restart FRR (last resort)
restart routing-daemon static

2. The next-hop is unreachable

Symptoms: The route is in the table, but traffic does not pass.

Checks:

# Check ARP for the next-hop
show arp | grep 192.168.1.1

# Ping the next-hop
ping 192.168.1.1

# Check the interface
show interfaces ethernet eth0

Solution:

# Check the physical connection
show interfaces ethernet eth0 physical

# Clear the ARP cache
reset arp interface eth0

# Verify the interface IP address is in the same subnet as the gateway
show interfaces

# If needed - fix the IP
set interfaces ethernet eth0 address 192.168.1.10/24
commit

3. DHCP conflicts with the static route

Symptoms: DHCP overwrites the static default route.

Checks:

# Show all default routes
show ip route 0.0.0.0

# Check the DHCP configuration
show interfaces ethernet eth0 | grep dhcp

Solution:

# Option 1: Disable DHCP option 3 (gateway)
set interfaces ethernet eth0 dhcp-options no-default-route
commit
save

# Option 2: Use a lower distance for the static route
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1 distance 1
commit
save

# DHCP routes usually have a distance > 20

4. Failover does not switch over

Symptoms: When the primary route fails, the backup is not activated.

Checks:

# Check the distance of both routes
show ip route 0.0.0.0 detail

# Check connectivity to the next-hops
ping 192.168.1.1
ping 192.168.2.1

# Check BFD (if used)
show protocols bfd peers

Solution:

# Make sure the distances differ
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1 distance 1
set protocols static route 0.0.0.0/0 next-hop 192.168.2.1 distance 10
commit
save

# Configure BFD for fast detection
set protocols bfd peer 192.168.1.1 interval transmit 300
set protocols bfd peer 192.168.1.1 interval receive 300
set protocols bfd peer 192.168.1.1 interval multiplier 3

set protocols static route 0.0.0.0/0 next-hop 192.168.1.1 bfd
commit
save

5. ECMP does not balance traffic

Symptoms: All traffic goes through one of the routes.

Checks:

# Check that both routes are in the table
show ip route 0.0.0.0

# There should be two next-hops with the same distance and metric

# Check the multipath configuration
show configuration system ip multipath

Solution:

# Make sure the distance and metric are the same
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1
set protocols static route 0.0.0.0/0 next-hop 192.168.1.2

# Enable layer4-hashing
set system ip multipath layer4-hashing

commit
save

# Check kernel balancing
ip route show 0.0.0.0/0
# Should show: nexthop via 192.168.1.1 ... nexthop via 192.168.1.2

6. The IPv6 default route is missing

Symptoms: IPv4 works, but there is no IPv6 connectivity.

Checks:

# Check IPv6 routes
show ipv6 route ::/0

# Check IPv6 on the interface
show interfaces ethernet eth0 | grep inet6

# Check RA (if autoconfiguration is expected)
tcpdump -i eth0 -n icmp6

Solution:

# Option 1: A static IPv6 route
set protocols static route6 ::/0 next-hop 2001:db8::1
commit
save

# Option 2: Autoconfiguration via RA
set interfaces ethernet eth0 ipv6 address autoconf
commit
save

# Check connectivity
ping6 2001:4860:4860::8888

7. The route is in the table, but traffic does not flow

Symptoms: show ip route shows the route, but ping does not work.

Checks:

# Check the firewall
show firewall

# Check NAT (if this is an edge router)
show nat source rules

# Check IP forwarding
sysctl net.ipv4.ip_forward

# Check the interface status
show interfaces

Solution:

# Make sure IP forwarding is enabled (it should be by default)
# Do NOT use this command (it DISABLES forwarding):
# set system ip disable-forwarding

# Check that forwarding is active
sysctl net.ipv4.ip_forward
# Should be: net.ipv4.ip_forward = 1

# Configure NAT for outbound traffic (if needed)
set nat source rule 100 outbound-interface eth0
set nat source rule 100 source address 192.168.0.0/16
set nat source rule 100 translation address masquerade

# Allow outbound traffic in the firewall
set firewall name LAN_OUT rule 10 action accept
set firewall interface eth1 out name LAN_OUT

commit
save

8. Yandex Cloud connectivity issues

Symptoms: VyOS in Yandex Cloud cannot reach the internet.

Checks:

# Check the IP configuration
show interfaces

# Check the default route
show ip route 0.0.0.0

# Ping the Yandex Cloud gateway (the first IP of the subnet)
ping 10.128.0.1

# Check the Yandex Cloud metadata service
curl http://169.254.169.254/latest/meta-data/

Solution:

# Correct configuration for Yandex Cloud
# Gateway = the first IP in the subnet

# For the subnet 10.128.0.0/24:
set interfaces ethernet eth0 address 10.128.0.10/24
set protocols static route 0.0.0.0/0 next-hop 10.128.0.1

# For the subnet 192.168.1.0/24:
set interfaces ethernet eth0 address 192.168.1.10/24
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1

commit
save

# Check the Security Group in the Yandex Cloud Console
# It should allow outbound ICMP, TCP, and UDP

Best practices

1. Documenting routes

Always add a description to your default routes:

set protocols static route 0.0.0.0/0 next-hop 192.168.1.1
set protocols static route 0.0.0.0/0 description 'Primary ISP - Provider A'

set protocols static route 0.0.0.0/0 next-hop 192.168.2.1 distance 10
set protocols static route 0.0.0.0/0 description 'Backup ISP - Provider B'

commit
save

2. Using distance for prioritization

Recommended distance values:

Primary static route: 1-5
Backup static route: 10-20
DHCP-learned route: usually 20+ (automatic)
Dynamic protocols: 110 (OSPF), 200 (BGP)

# Primary
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1 distance 1

# Backup
set protocols static route 0.0.0.0/0 next-hop 192.168.2.1 distance 10

# Emergency (for example, over an expensive LTE link)
set protocols static route 0.0.0.0/0 next-hop 192.168.3.1 distance 20

3. ECMP for balancing

Use ECMP only for links with equal bandwidth:

# Two links of 100 Mbps each
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1
set protocols static route 0.0.0.0/0 next-hop 192.168.1.2

set system ip multipath layer4-hashing

commit
save

Do not use ECMP for links with different bandwidth (100 Mbps + 10 Mbps) - this leads to inefficient utilization.

4. BFD for critical routes

For production, use BFD for fast failure detection:

# BFD with aggressive timers for critical systems
set protocols bfd peer 192.168.1.1 interval transmit 300
set protocols bfd peer 192.168.1.1 interval receive 300
set protocols bfd peer 192.168.1.1 interval multiplier 3

set protocols static route 0.0.0.0/0 next-hop 192.168.1.1 bfd

# Backup route
set protocols static route 0.0.0.0/0 next-hop 192.168.2.1 distance 10

commit
save

Failover time: 300ms x 3 = 900ms with aggressive settings.

5. IPv6 on par with IPv4

Always configure the IPv6 default route alongside IPv4:

# IPv4
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1

# IPv6
set protocols static route6 ::/0 next-hop 2001:db8::1

commit
save

6. NAT for edge routers

Pair the default route with NAT for outbound traffic:

# Default route
set protocols static route 0.0.0.0/0 next-hop 192.168.1.1

# Source NAT on the outbound interface
set nat source rule 100 outbound-interface eth0
set nat source rule 100 source address 10.0.0.0/8
set nat source rule 100 translation address masquerade

commit
save

7. Monitoring routes

Check the state of your routes regularly:

# A monitoring script
cat > /config/scripts/check-default-route.sh << 'EOF'
#!/bin/bash

ROUTE=$(ip route show 0.0.0.0/0)

if [ -z "$ROUTE" ]; then
    logger -t DEFAULT_ROUTE "CRITICAL: No default route found"
    # Send an alert
    echo "No default route!" | mail -s "VyOS Alert" admin@example.com
else
    logger -t DEFAULT_ROUTE "OK: Default route is present"
fi
EOF

chmod +x /config/scripts/check-default-route.sh

# Schedule the check
set system task-scheduler task check-route interval '*/5 * * * *'
set system task-scheduler task check-route executable path '/config/scripts/check-default-route.sh'

commit
save

8. Cloud providers

Yandex Cloud:

Gateway = the first IP in the subnet
Use static routes (do not rely on DHCP option 3)
Verify Security Groups for outbound connectivity

VK Cloud:

Similar to Yandex Cloud - the gateway is the first IP
Dual-homed configuration for redundancy
Use distance for failover

AWS, Azure, GCP:

DHCP is usually used for the default route
For static routes, check the VPC route tables
Account for route propagation in the cloud

9. Configuration backup

Always save the working config after changing routes:

# After configuring the routes
commit
save

# Create a backup
save /config/backups/config-$(date +%Y%m%d-%H%M).boot

10. Testing before production

Verify routes before rolling them out:

# 1. Check connectivity
ping 8.8.8.8

# 2. Traceroute
traceroute 8.8.8.8

# 3. DNS resolution
nslookup google.com

# 4. Check failover (if configured)
# Temporarily disable the primary next-hop and verify the switchover

# 5. Check ECMP balancing
for i in {1..10}; do traceroute -n 8.8.8.$i | head -2; done

Comparison with other platforms

Cisco IOS

Cisco IOS:

ip route 0.0.0.0 0.0.0.0 192.168.1.1

VyOS equivalent:

set protocols static route 0.0.0.0/0 next-hop 192.168.1.1

Juniper JunOS

Juniper JunOS:

set routing-options static route 0.0.0.0/0 next-hop 192.168.1.1

VyOS equivalent:

set protocols static route 0.0.0.0/0 next-hop 192.168.1.1

MikroTik RouterOS

MikroTik:

/ip route add dst-address=0.0.0.0/0 gateway=192.168.1.1

VyOS equivalent:

set protocols static route 0.0.0.0/0 next-hop 192.168.1.1

Linux iproute2

Linux:

ip route add default via 192.168.1.1

VyOS equivalent:

set protocols static route 0.0.0.0/0 next-hop 192.168.1.1

Conclusion

The default route is a critically important element of a VyOS configuration, defining the path for all outbound traffic that has no more specific route. Modern VyOS uses the protocols static route syntax to configure the default route for both IPv4 (0.0.0.0/0) and IPv6 (::/0).

Key takeaways:

Use distance for failover between multiple routes
ECMP with layer4-hashing for balancing across equal-cost links
BFD for fast detection of next-hop failures
Always document routes with description
Verify connectivity after making changes

For cloud environments (Yandex Cloud, VK Cloud), use static routes with the gateway set to the first IP in the subnet. For fault tolerance, configure multiple routes with different distances, optionally with BFD for fast failover.

A correct default route configuration ensures reliable connectivity with external networks and is the foundation for building scalable, fault-tolerant network infrastructure based on VyOS.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

Updates - Upgrading the VyOS System