VRF-leaking and access to local ip?

1

Im experimenting with VyOS and VRFs (started with MGMT and PROD) along with containers.

Long story short I have found that “allow-host-networks” is the least worst setup/workaround.

However for that to work I need to apply VRF-leaking so that what lives in vrf default will be able to reach vrf PROD, like so:

# Original vrf PROD routes
set vrf name PROD protocols static route 0.0.0.0/0 next-hop 192.168.1.254 interface 'eth1'

# So accessing external hosts through gateway in vrf PROD will work for vrf default services
set protocols static route 0.0.0.0/0 next-hop 192.168.1.254 vrf 'PROD'

# So accessing local subnet will work for vrf default services
set protocols static route 192.168.1.0/24 interface eth1 vrf 'PROD'

The above also resolves issues for VyOS local services (doing egress traffic) such as “set system name-server” who currently isnt VRF-aware.

However with the above what doesnt work is for a vrf default service to access the IP-address of eth1 who lives in PROD.

After some troubleshooting this turns out to be the fix:

ip route replace local 192.168.1.20/32 dev eth1 table main

But I like to have this within the vyos config itself instead of making a posthook-script.

I have tried both:

set protocols static route 192.168.1.20/32 interface eth1

and

set protocols static route 192.168.1.20/32 interface eth1 vrf 'default'

without success.

Is there some way to add the ip route I need in vyos config or must how protocol static route works be changed?

2

The difference is that the row local 192.168.1.20 dev eth1 scope host gets added in the routing table:

# ip route show table all | grep -i 192.168.1
default nhid 22 via 192.168.1.254 dev eth1 table PROD proto static metric 20 
192.168.1.0/24 dev eth1 table PROD proto kernel scope link src 192.168.1.20 
local 192.168.1.20 dev eth1 table PROD proto kernel scope host src 192.168.1.20 
broadcast 192.168.1.255 dev eth1 table PROD proto kernel scope link src 192.168.1.20 
default nhid 22 via 192.168.1.254 dev eth1 proto static metric 20 
192.168.1.0/24 nhid 12 dev eth1 proto static metric 20 
local 192.168.1.20 dev eth1 scope host

So question is how to make local 192.168.1.20 dev eth1 scope host show up with just vyos config without involving posthook-scripts?

3

Filed as feature request over at ⚓ T9597 Add ability to add local route-type when using set protocol static unless someone in here who can point out what I missed syntaxwise in vyos config to make this work? :slight_smile: