Page MenuHomeVyOS Platform

IPSec with vti interfaces by default add default route to table 220


If we use vti interface and IPSec, it auto add a default route to table 220
In that case after this tunnel will be established we lose access to the VyOS instance.


[email protected]:~$ show int
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface        IP Address                        S/L  Description
---------        ----------                        ---  -----------
eth0                    u/u  Wan
eth1                        u/u  Lan
eth2             -                                 u/u  
lo                            u/u  
vti1                        A/D  Tunnel to

The default route should be via eth0:
And we see this entry

[email protected]:~$ show ip route
Routing entry for
  Known via "static", distance 1, metric 0, best
  Last update 00:11:43 ago
  *, via eth0, weight 1

[email protected]:~$

But IPSec adds more priority route via table 220 on listening VPN interface eth1:

[email protected]:~$ sudo ip route get via dev eth1 table 220 src uid 0 
[email protected]:~$

To prevent it we must set this command and reset VPN peer or reboot the router:

set vpn ipsec options disable-route-autoinstall

The routes will be correct:

[email protected]# sudo ip route get dev eth0 src uid 0 
[email protected]#

Adding this option by default seems like a smart decision.
It located in /etc/strongswan.d/charon.conf

# Install routes into a separate routing table for established IPsec
# tunnels.
install_routes = no

Also it was some discussion in T628


Difficulty level
Unknown (require assessment)
VyOS 1.3-beta-202110290638
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)

Event Timeline

Viacheslav changed the subtype of this task from "Bug" to "Feature Request".

Require migration scripts to check option set vpn ipsec options disable-route-autoinstall in the configuration

syncer triaged this task as Normal priority.