The office
Two VyOS routers serving one office LAN: VRRP for a gateway that survives a router failure, DHCP with split pools and a printer reservation, and DNS forwarding. Then a real failover, the DNS outage it exposed, and the fix.
By the end you will be able to:
- Configure VRRP with a sync group so both sides of a router fail over together
- Run DHCP on two routers with split pools and a static mapping
- Forward DNS from the LAN through VyOS
- Measure a real failover and explain the advertisement timers
- Make DNS fail over with the gateway by listening on the virtual address
Prerequisites: Switching basics: layer 2, VLANs and IP addressing, Setting up VyOS with NAT
Every office LAN needs the same three services from its router: an address for each device (DHCP), a way to look up names (DNS), and a default gateway that doesn't take the whole office offline when one router fails (VRRP). The NAT and Switching basics lessons assumed hosts already had addresses and a gateway. This lesson builds the router side.
The lab is a small office with two VyOS routers, R1 and R2, on the same LAN (10.0.0.0/24) and the same ISP segment (203.0.113.0/29). On the LAN, pc1 is an ordinary computer, and pc2 is a "printer" that should always get the same address. On the ISP side there's a resolver at 192.0.2.53 and a web server, server.example.net, at 192.0.2.80.
| R1 | R2 | Shared (virtual) | |
|---|---|---|---|
| LAN | 10.0.0.2 | 10.0.0.3 | 10.0.0.1, the gateway everyone uses |
| WAN | 203.0.113.2 | 203.0.113.3 | 203.0.113.4, where the ISP routes our LAN |
| VRRP priority | 200 (normally master) | 100 |
Everything runs in one container: both routers as VyOS virtual machines, the LAN and ISP segments as Linux bridges, and the PCs and ISP as network namespaces. Every output comes from that lab, including the failures.
- DHCP. pc1 broadcasts a DISCOVER; both routers offer from their half of the pool, with gateway 10.0.0.1.
- R1 is master. R1 holds 10.0.0.1 and 203.0.113.4; all traffic goes through it.
- R1 fails. R2 stops hearing advertisements, takes both virtual addresses after about 3.5 s, and announces them with gratuitous ARP.
- DNS follows only if it's on the VIP. With DNS on 10.0.0.1, lookups move with the gateway. With DNS on 10.0.0.2, every lookup waits for the dead router first.
set system host-name 'R1'
set interfaces ethernet eth0 address '10.0.0.2/24'
set interfaces ethernet eth0 description 'LAN'
set interfaces ethernet eth1 address '203.0.113.2/29'
set interfaces ethernet eth1 description 'WAN'
set protocols static route 0.0.0.0/0 next-hop '203.0.113.1'- Lines 2–3: R1's own LAN address; .1 is reserved for the virtual gateway.
- Lines 4–5: WAN.
- Line 6: To the ISP.