Intermediate · Two internet connections on VyOS · section 6 of 7

Checklist and troubleshooting

✓ Lab-tested 21 October 2026 on VyOS 2026.10.16-0024-rolling, Debian 12 hosts

Checklist

[ ] A health check per ISP that tests beyond the ISP's router, with a host route to its target through that ISP.
[ ] Source NAT per ISP (or VyOS's own, without disable-source-nat).
[ ] sticky-connections inbound if anything is published through more than one ISP.
[ ] flush-connections, so stalled connections fail fast and reconnect.
[ ] failure-count and success-count chosen deliberately: faster failover, or fewer false alarms.
[ ] The router's own traffic (DNS lookups, VPN tunnels, NTP) uses the main routing table, not the load-balancing rules. Make sure it can fail over too: enable-local-traffic, or protocols that pick their own path.
[ ] Inbound services remember that the backup ISP's address is different: DNS records, VPN endpoints and allow-lists elsewhere need both.
[ ] A real test: break the main ISP upstream of its router, and watch.

Troubleshooting

Symptom	Likely cause	Check
Main ISP down, office offline, backup unused	No health check, or one that only pings the next hop	`show wan-load-balance`; ping a target beyond the ISP
The backup is marked failed although it works	No route to its test target through that ISP	A host route to the target via the backup's next hop
Port forward works through one ISP only	Replies leave through the other ISP	`sticky-connections inbound`; `tcpdump` on the other WAN
Calls and VPNs hang after a failover	Existing connections still pinned to the failed ISP	`flush-connections`
Traffic flips between ISPs	Health check too sensitive, or an unreliable target	Raise `failure-count`; pick a better target
Outbound traffic via the backup is dropped by the ISP	Wrong source address: NAT missing for that interface	`show nat source rules`; the server's log

R1's final configuration

set interfaces ethernet eth0 address '203.0.113.2/30'
set interfaces ethernet eth0 description 'ISP1'
set interfaces ethernet eth1 address '198.51.100.2/30'
set interfaces ethernet eth1 description 'ISP2'
set interfaces ethernet eth2 address '10.0.0.1/24'
set interfaces ethernet eth2 description 'LAN'
set load-balancing wan disable-source-nat
set load-balancing wan flush-connections
set load-balancing wan interface-health eth0 failure-count '2'
set load-balancing wan interface-health eth0 nexthop '203.0.113.1'
set load-balancing wan interface-health eth0 success-count '1'
set load-balancing wan interface-health eth0 test 10 target '192.0.2.101'
set load-balancing wan interface-health eth0 test 10 type 'ping'
set load-balancing wan interface-health eth1 failure-count '2'
set load-balancing wan interface-health eth1 nexthop '198.51.100.1'
set load-balancing wan interface-health eth1 success-count '1'
set load-balancing wan interface-health eth1 test 10 target '192.0.2.102'
set load-balancing wan interface-health eth1 test 10 type 'ping'
set load-balancing wan rule 10 description 'LAN: ISP1, failing over to ISP2'
set load-balancing wan rule 10 failover
set load-balancing wan rule 10 inbound-interface 'eth2'
set load-balancing wan rule 10 interface eth0 weight '10'
set load-balancing wan rule 10 interface eth1 weight '1'
set load-balancing wan sticky-connections inbound
set nat destination rule 10 description 'Web server, via ISP1'
set nat destination rule 10 destination port '80'
set nat destination rule 10 inbound-interface name 'eth0'
set nat destination rule 10 protocol 'tcp'
set nat destination rule 10 translation address '10.0.0.10'
set nat destination rule 20 description 'Web server, via ISP2'
set nat destination rule 20 destination port '80'
set nat destination rule 20 inbound-interface name 'eth1'
set nat destination rule 20 protocol 'tcp'
set nat destination rule 20 translation address '10.0.0.10'
set nat source rule 10 description 'LAN out via ISP1'
set nat source rule 10 outbound-interface name 'eth0'
set nat source rule 10 source address '10.0.0.0/24'
set nat source rule 10 translation address 'masquerade'
set nat source rule 20 description 'LAN out via ISP2'
set nat source rule 20 outbound-interface name 'eth1'
set nat source rule 20 source address '10.0.0.0/24'
set nat source rule 20 translation address 'masquerade'
set protocols static route 0.0.0.0/0 next-hop 198.51.100.1 distance '10'
set protocols static route 0.0.0.0/0 next-hop 203.0.113.1 distance '1'
set protocols static route 192.0.2.101/32 next-hop 203.0.113.1
set protocols static route 192.0.2.102/32 next-hop 198.51.100.1

Lines 7–24: Load balancing: failover, health checks beyond each ISP, flushing and sticky inbound connections.
Lines 25–42: Port forwards and source NAT, one per ISP.
Lines 43–46: Default routes for R1's own traffic, and host routes to the health-check targets.

Healthy (real output)

vyos@R1:~$ show wan-load-balance
Interface: eth0
Status: active
Last Status Change: 2026-10-21 09:37:49
Last Interface Success: 0:00:50.564128
Last Interface Failure: N/A
Interface Failures: 0

Interface: eth1
Status: active
Last Status Change: 2026-10-21 09:37:49
Last Interface Success: 0:00:50.395529
Last Interface Failure: N/A
Interface Failures: 0