Intermediate · Two internet connections on VyOS · section 2 of 7

A backup default route

✓ Lab-tested 21 October 2026 on VyOS 2026.10.16-0024-rolling, Debian 12 hosts

The simplest design is two default routes with different distances: ISP1's at 1 is used, and ISP2's at 10 waits in reserve. Each ISP gets its own source NAT rule, so traffic leaving through it carries its own address. Normally the LAN's traffic leaves through ISP1, and the server sees 203.0.113.2.

The failure it can't see

A backup route like this takes over only when the main route disappears, which happens when R1's own interface goes down. But most outages happen further away: the ISP's router is fine, and something behind it isn't.

In the lab, ISP1 lost its own upstream link. R1's link to ISP1 stayed up, and ISP1's router still answered R1's pings. So the main route stayed installed, ISP2's route stayed unused (Status: None), and the office was offline, with a working second connection sitting idle.

This is the most common way "redundant" internet connections fail, and nobody finds out until the day it matters.

R1: two default routes and NAT per ISP

set system host-name 'R1'
set interfaces ethernet eth0 address '203.0.113.2/30'
set interfaces ethernet eth0 description 'ISP1'
set interfaces ethernet eth1 address '198.51.100.2/30'
set interfaces ethernet eth1 description 'ISP2'
set interfaces ethernet eth2 address '10.0.0.1/24'
set interfaces ethernet eth2 description 'LAN'
set protocols static route 0.0.0.0/0 next-hop 203.0.113.1 distance '1'
set protocols static route 0.0.0.0/0 next-hop 198.51.100.1 distance '10'
set nat source rule 10 description 'LAN out via ISP1'
set nat source rule 10 outbound-interface name 'eth0'
set nat source rule 10 source address '10.0.0.0/24'
set nat source rule 10 translation address 'masquerade'
set nat source rule 20 description 'LAN out via ISP2'
set nat source rule 20 outbound-interface name 'eth1'
set nat source rule 20 source address '10.0.0.0/24'
set nat source rule 20 translation address 'masquerade'

Lines 2–7: ISP1, ISP2 and the LAN.
Lines 8–9: ISP1's default route wins (distance 1); ISP2's waits (distance 10).
Lines 10–17: Source NAT to each ISP's own address.

Normal operation (real output)

root@lanhost:~# curl -s -m 3 http://192.0.2.10/
hello from server

root@server:~# tail -1 /tmp/http.log
203.0.113.2 - - [21/Oct/2026 09:20:30] "GET / HTTP/1.1" 200 -

Lines 4–5: The server sees the office as ISP1's address.

Two default routes, one in use (real output)

vyos@R1:~$ show ip route 0.0.0.0/0
Routing entry for 0.0.0.0/0
  Known via "static", distance 1, metric 0, best
  Last update 00:00:24 ago
  Flags: Recursion Selected RR Distance
  Status: Installed
  * 203.0.113.1, via eth0, weight 1

Routing entry for 0.0.0.0/0
  Known via "static", distance 10, metric 0
  Last update 00:00:24 ago
  Flags: Recursion RR Distance
  Status: None
    198.51.100.1, via eth1, weight 1

Lines 3–7: ISP1's route is installed.
Lines 10–14: ISP2's is known but not used (Status: None).

ISP1 loses its upstream (real output)

root@isp1:~# ip link set eth1 down   # ISP1 loses its own upstream; the link to R1 stays up

root@lanhost:~# curl -s -m 5 http://192.0.2.10/ || echo "no answer"
no answer

Line 1: Broken behind ISP1's router; R1's link to it is untouched.
Lines 3–4: The office is offline.

…and R1 can't tell (real output)

vyos@R1:~$ ping 203.0.113.1 count 2
PING 203.0.113.1 (203.0.113.1) 56(84) bytes of data.
64 bytes from 203.0.113.1: icmp_seq=1 ttl=64 time=1.65 ms
64 bytes from 203.0.113.1: icmp_seq=2 ttl=64 time=2.46 ms

--- 203.0.113.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1005ms
rtt min/avg/max/mdev = 1.649/2.053/2.457/0.404 ms
vyos@R1:~$ show ip route 0.0.0.0/0
Routing entry for 0.0.0.0/0
  Known via "static", distance 1, metric 0, best
  Last update 00:00:47 ago
  Flags: Recursion Selected RR Distance
  Status: Installed
  * 203.0.113.1, via eth0, weight 1

Routing entry for 0.0.0.0/0
  Known via "static", distance 10, metric 0
  Last update 00:00:47 ago
  Flags: Recursion RR Distance
  Status: None
    198.51.100.1, via eth1, weight 1

Lines 1–8: ISP1's router still answers.
Lines 9–22: So the main route stays, and ISP2's stays unused.

Check your understanding

ISP1's router is up but its link to the rest of the internet has failed. Why doesn't ISP2's distance-10 route take over?

A backup static route only takes over when the main route disappears, and that needs R1's own interface to go down.
Because ISP2's route has the higher distance.
Because the NAT rules point at ISP1.
Because VyOS needs a reboot to change routes.