Route selection


I have some problems to get vyos to select the best route. For net I have a route that get’s pushed by OpenVPN server (I have no control over that server) and a wireguard tunnel with a corresponding static route.
It chooses the kernel route (by OpenVPN) instead of the static route. How do I get it to use the static route via wireguard?
Any help is appreciated.

$ sh ip ro
Codes: K - kernel route, C - connected, S - static, R - RIP,
       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
       T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
       F - PBR, f - OpenFabric,
       > - selected route, * - FIB route, q - queued, r - rejected, b - backup

S>* [210/0] via, eth0, weight 1, 00:11:39
K>* [0/50] via, vtun1, 00:04:57
K>* [0/50] via, vtun1, 00:04:57
K>* [0/50] via, vtun1, 00:04:57
S [1/0] is directly connected, wg1, weight 1, 00:11:36

VyOS is selecting the best route as it sees it.

In the routing table you will see [0/50] and [1/0] after your route. The first number is called the administrative distance (AD). The lower the AD, the more trustworthy the route source is supposed to be. Since OpenVPN is setting kernel routes, it is going to zero. Your static route can change the AD, but you can’t set a value outside of 1-255.

The second number is the metric. This is where you’d usually find a cost analysis between multiple paths to determine the best path within a given routing protocol (static, RIP, OSPF, BGP, EIGRP, ISIS, etc).

You might be able to use some combination of OpenVPN option pull-filter to suppress that specific route, and re-add it as a static route with a AD higher than the AD of the WireGuard route.

Reference for OpenVPN 2.4: Reference Manual For OpenVPN 2.4 | OpenVPN

Something like the below might work for OpenVPN options (order is important):

–pull-filter accept “route 10.0”
–pull-filter accept “route 10.1”
–pull-filter ignore "route "

Then you could try to add the route manually as such:

set protocols route static next-hop distance 2


Thank you! That helped immensely.
It’s working fine with pull-filter

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.