VRRP
VRRP (Virtual Router Redundancy Protocol) lets two routers share one gateway address. One is master: it holds the virtual address and answers for it. The other is backup: it listens for the master's advertisements (one per second by default) and takes over if they stop. Hosts never know there are two routers; they just use 10.0.0.1.
On VyOS, each group needs a virtual router ID (VRID, unique per LAN), an interface, the virtual address and a priority. The highest priority becomes master.
Two groups, not one, because the router has two sides. If R1 failed on the LAN side only, R2 would take the LAN gateway, but the ISP would still send return traffic to R1's WAN side. A sync group ties the LAN and WAN groups together, so they always fail over as a pair. The ISP routes our LAN to the WAN virtual address 203.0.113.4, so return traffic always reaches the current master.
After the commit, R1 is master of both groups and holds 10.0.0.1 alongside its own 10.0.0.2. R2 is backup.
set high-availability vrrp group LAN vrid '10'
set high-availability vrrp group LAN interface 'eth0'
set high-availability vrrp group LAN address '10.0.0.1/24'
set high-availability vrrp group LAN priority '200'
set high-availability vrrp group WAN vrid '20'
set high-availability vrrp group WAN interface 'eth1'
set high-availability vrrp group WAN address '203.0.113.4/29'
set high-availability vrrp group WAN priority '200'
set high-availability vrrp sync-group MAIN member 'LAN'
set high-availability vrrp sync-group MAIN member 'WAN'- Lines 1–4: The LAN gateway: VRID 10, 10.0.0.1.
- Line 4: 200 beats R2's 100: R1 is normally master.
- Lines 5–8: The WAN side, where the ISP sends return traffic.
- Lines 9–10: Fail over both together.
vyos@R1:~$ show vrrp
Name Interface VRID State Priority Last Transition
------ ----------- ------ ------- ---------- -----------------
LAN eth0 10 MASTER 200 32s
WAN eth1 20 MASTER 200 32s
vyos@R2:~$ show vrrp
Name Interface VRID State Priority Last Transition
------ ----------- ------ ------- ---------- -----------------
LAN eth0 10 BACKUP 100 16s
WAN eth1 20 BACKUP 100 16s
vyos@R1:~$ show interfaces ethernet eth0 brief
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 10.0.0.2/24 u/u LAN
10.0.0.1/24- Lines 4–5: R1: master of both.
- Lines 9–10: R2: backup.
- Lines 15–16: R1 holds the virtual address next to its own.
Check your understanding
Why put the LAN and WAN VRRP groups in a sync group?
- So both move together: otherwise one router could hold the LAN gateway while return traffic arrives at the other
- VRRP only allows one group per router
- To share the DHCP leases
- So the priority applies twice