High Availability on VyOS: VRRP and Conntrack Sync
High availability (HA) is a critical requirement in network systems. VyOS supports VRRP (Virtual Router Redundancy Protocol) and conntrack-sync to synchronize NAT/connection state between nodes.
VRRP: Virtual Router Redundancy Protocol
VRRP allows multiple routers to share a virtual IP address. If the primary node fails, the standby node takes over that address.
set high-availability vrrp group G1 interface eth0
set high-availability vrrp group G1 virtual-address 192.168.100.254/24
set high-availability vrrp group G1 priority 200
set high-availability vrrp group G1 preempt true
set high-availability vrrp group G1 rfc-compatibility 3
Conntrack Sync: NAT/connection state synchronization
set service conntrack-sync interface eth1
set service conntrack-sync accept-protocol vrrp
This ensures NAT sessions are not interrupted during failover.
Config sync between HA peers
set service config-sync peer 192.168.100.2
set service config-sync interface eth1
NAT rules for HA
Apply NAT rules for the virtual IP:
set nat source rule 100 outbound-interface eth0
set nat source rule 100 source address 192.168.100.0/24
set nat source rule 100 translation address masquerade
Failover monitoring and control
show high-availability vrrp
show service conntrack-sync
HA design: VM primary + physical backup
A recommended deployment is a primary VyOS VM with a physical backup appliance for stronger reliability.
Hands-on lab: VyOS HA pair with VRRP + Conntrack Sync
- Configure a VRRP group on both VyOS nodes with different priorities.
- Configure conntrack-sync on the internal synchronization interface.
- Test failover by shutting down the primary node and observe virtual IP takeover.
- Verify NAT/connection state after failover.
# Kiểm tra trạng thái VRRP
show high-availability vrrp
# Kiểm tra đồng bộ conntrack
show service conntrack-sync
Summary
This lesson helps you build HA on VyOS with VRRP, conntrack-sync, and NAT design, then validate failover behavior in practical labs to minimize downtime.