Use of VRF in dual WAN setup

Tue, 04 Aug 2026 02:28:23 +0530

Over the weekend I migrated my home router from multiple routing tables to a VRF-based design, placing each WAN uplink into its own VRF. While multiple routing tables worked for basic policy routing, they have some limitations and that led to several edge cases that became increasingly difficult to work around.

Issues with the setup:

If the active default route pointed to ISP1, traffic arriving on ISP1 naturally returned via ISP1. However, traffic terminating on the router and arriving via ISP2 would also be replied to through ISP1, since both uplinks still shared the same routing domain. This did not cause issues for traffic on devices below the router but was bad for traffic terminating on the router interface itself.
Due to the above reason, I recently lost access to my home router while I was out of the country because ISP1 had a partial outage (their transit went down, peering stayed up) & due to distributed tooling, the auto switch trigger could not happen either to take care of it. Packets from ISP 2 were being returned via the ISP1 route & thus blackholed.
I have a special case where I want most of the devices on a redundant setup but some devices (containers) on specific ISP only. These are measurement containers running blackbox exporter behind a specific ISP as well as RIPE Atlas. I don’t want these to switch over for accuracy of measurement. Without VRF it was ugly config-wise, as ISP1 failure will lead to ISP2 routing even when the specific routing table did not have that route.

Old Setup

My old setup was running multiple routing table pairs:

ISP1 only & ISP1 as primary (ISP2 as secondary)
ISP2 only & ISP2 as primary (ISP1 as secondary)

All WAN interfaces, LAN interfaces and routing tables were in the same single “Main” VRF. This by default takes care of full outage events, fibre cuts, etc. For packet loss-based switchover, I have set up Prometheus + Semaphore as covered in this post last year.

Understanding VRF

VRF is Virtual Routing and Forwarding. It allows “virtual partitioning” of the router in L3 terms. Different physical & VLAN interfaces can be part of different VRFs, and they have no connectivity with each other at all unless routes are leaking between the VRFs. Thus a router with VRF - Main, ISP1 & ISP2 acts like three separate routers. It’s like a VLAN for layer3. In Mikrotik it can get confusing as one can create multiple isolated routing tables in the same Main VRF however since WAN interfaces are also in the same main VRF, the default route from the main table takes out if a next-hop becomes unavailable on an interface.

New Setup

With three VRFs in place (default + 2 other), I have isolated each uplink in its own VRF. Also, removed the ISP1-only & ISP2-only routing tables, as VRF creates its own isolated table. Most of the policy-routing logic remains unchanged. Mangle does the marking of routing to steer traffic & mangle rules for an address list where IPs are enabled or disabled from external tooling based on how I want to route the traffic. Every WAN-facing route now belongs to the corresponding VRF instead of the Main routing domain. And since these act like separate routers, I had to add a path for the return route as well. So e.g if 172.16.0.0/24 on say VLAN10 (in Main VRF) communicates via VRF-ISP2 via mangle-marked routing, the VRF-ISP2 routing table needed an interface route to return the traffic. For VLANs specific to these ISPs, I added them in the respective ISP VRF. These VLANs are also trunked to my home server, where they map directly onto Docker networks, allowing selected containers to live natively inside a specific ISP VRF

In hindsight, I should have switched to VRFs much earlier. Multiple routing tables worked for a long time, but they started showing their limits as the network became more complex. VRFs make the separation explicit, and the router behaves much closer to how I actually expect it to.

VRF on Personal blog of Anurag Bhatia

Use of VRF in dual WAN setup

Old Setup

Understanding VRF

New Setup