I have a EdgeSwitch 16 XG, and I'm configuring 802.1X port access control with a FreeRadius server.

I have 2 VLAN for this setup : VLAN 3 and VLAN 5. I want clients to go either on one or the other based on the authentication.

On a port I enabled Mac-Based 802.1X Port Access Control. I set up a guest vlan ID (5).

On the same port I set up the VLAN with untagged VLAN 3 and untagged VLAN 5 with PVID 5.

On this port if a client connect without any 802.1X security it goes in VLAN 5. If it connects using 802.1X (user configured on FreeRadius with vlan id 3) it goes in VLAN 3. I'm using DHCP on each VLAN with different subnet and getting IP corresponding.

So in this way the config is working.

Here is the configuration on the switch :

show running-config interface 0/13

!Current Configuration:
!
interface  0/13
dot1x port-control mac-based
dot1x timeout quiet-period 5
dot1x guest-vlan 5
dot1x timeout guest-vlan-period 5
vlan pvid 5
vlan participation include 3,5

But with this configuration I see a problem : either i'm on guest VLAN 5 or connected and assigned to VLAN 3, i'm receiving the multicast/broadcast traffic of both VLAN (I can see it on Wireshark).

I think this is because both VLAN 3 and 5 are untagged.

So I tried the same but assigning VLAN 3 as tagged.

But with this configuration if I want my clients do go on VLAN 3 I also need to configure tagged VLAN 3 (with 802.1).

Is this normal ? Is there a way to overcome this issue without tagging interfaces ?

Thanks

I am a new owner of a Edgerouter 4. I have updated the firmware to 4 3.0.1.

I have plugged in the router to my ISP optical fiber adapter, Internet is working fine.

The configuration is with a pppoe loggin (and Vlan 40 as indicated by EBOX, canadian ISP). I am now trying to optimize MTU size to 1492.

What I see now configured:  

Interface IP Address      S/L Description     

--------- ----------      --- -----------     

eth0       -         u/u         

eth0.40      -         u/u Internet (PPPoE)    

eth1       192.168.1.1/24     u/u Local       

eth2       192.168.2.1/24     u/D Local 2      

eth3         -         u/D         lo         127.0.0.1/8      u/u    ::1/128                

pppoe0  104.163.183.81     u/u         

ubnt@EdgeRouter-4:~$ show interfaces ethernet eth0.40

eth0.40@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 

group default qlen 1000  

I googled 2 methods to change the MTU to 1492. Both are not working.

The first thing I try is to use the GUI, but I see no 'action' button for any interface.

I then try using the CLI, this command:

set interfaces pppoe pppoe0 mtu 1492

IT does not work, if you look my currently configure Interface, my guess the name use in my command is wrong ?

Any help to resolve the situation is appreciated.

PS: I am not a total noob in networking, but I am new to CLI and EdgeOS.

Thanks.

I have an EdgeRouter X SFP and 2 aircubes. I want to prepare for deploying some cameras so I bought an Edgeswitch 16 150W. 

As part of the integration, I decided to move everything that I can to the switch, so the router should handle the internet connections only (primary and backup). The switch is connected to the server via SFP. I already moved everything and works fine, except my guest network. On the router I made a logical switch for the ports with name switch0. The guest network operated on switch0.6, used the vlan 6. The firewall rules are fine, I didnt touch them yet. On the switch I made a vlan for the same with 6 vlan id. The switch port, where the AP connects is Untagged on the default vlan and Tagged on the vlan 6.

I assumed it should work, but the clients can’t receive ip. What would you recommend to check?

Thanks in advance for any help!

PS: No vlan-aware used

The ER is currently set to failover to eth1, with the entire set of LAN IPs having access to both eth0 and eth1.

My goal is simple: create an address-group comprised of a sub-set of the group that accesses eth0, i.e. I don't want all LAN devices to be able to access the failover ISP (bandwidth considerations).

Creating an address-group or network group is easy. But I need to know how to tie this into existing configuration and firewall rules, relative to failover to eth1.

Should point out that there is already a firewall > modify > balance > rule 1, so if there needs to be another firewall rule prior to this one, this one will need to be moved.

Thanks for any pointers. Am comfortable with CLI, GUI, config tree... simple configuration command sequence preferred.

I have an automation that will reboot the router, but what I need to do is to have the router run the script to re-allow (Geo-IP table) outside IP ranges to a specific IP table that is used in routing rules to allow those outside IP ranges into services, without that table, all services are unavailable.

ls -al /config/scripts/post-config.d

total 3

drwxrwsr-x 1 root  vyattacf  224 Sep 4 14:18 .

drwxrwsr-x 1 root  vyattacf  232 Mar 5 2020 ..

-rwxr-xr-x 1 root  vyattacf  40 Sep 4 14:18 geo.sh

I have the geo.sh which calls the script I have, but it seems to not work:

sudo sh /config/zonefiles/country-load

I did a sudo reboot in PuTTY on the router and when it comes back up, it fails to run that script, as I know, because I'm sending log information to /var/log/countryload and there is no such file on reboot and all the services are offline from allowed Geo-IP table. I know the script works as I did an sh /config/scripts/post-config.d/geo.sh and it ran, the log file showed up and services came back.

What is missing to get this script setup to work properly?

Repo: https://github.com/bengoerz/erx-mt7530-switch-docs

Because this exposes the port mirroring built into the switch silicon, it should support a full 1Gbps port mirror. I plan to test the performance in my homelab soon.

Credit to gojimmypi's post https://gojimmypi.github.io/Edgerouter-Port-Monitor/ for sparking my curiosity.

I'd love to hear from anyone who has achieved full 1Gbps port mirroring on an ER-X already.

Yes, I found https://help.uisp.com/hc/en-us/articles/22591049434903-EdgeRouter-Port-Forwarding

Hints and tips sincerely appreciated!

# open port for httpd forwarding
set firewall name WAN_IN rule 22 action accept
set firewall name WAN_IN rule 22 description httpd
set firewall name WAN_IN rule 22 destination address 192.168.httpd apache server
set firewall name WAN_IN rule 22 destination port 8080
set firewall name WAN_IN rule 22 log disable
set firewall name WAN_IN rule 22 protocol tcp
# set firewall name WAN_IN rule 22 source port 8080 #- tried with and without this

# port-forward configuartion for httpd
set port-forward rule 3 description httpd
set port-forward rule 3 forward-to address 192.168.httpd apache server
set port-forward rule 3 forward-to port 8080
set port-forward rule 3 original-port 8080
set port-forward rule 3 protocol tcp

$ show configuration | no-more
firewall {
    all-ping enable
    broadcast-ping disable
    group {
        address-group ExtIP {
            address my Pub IP address
            description "Public IP (eth0)"
        }
        address-group PBX {
            address 34.210.91.112/28
            address 34.226.36.32/28
            address 136.57.136.147
            address 24.163.114.98
        }
    }
    ipv6-name WANv6_IN {
        default-action drop
        description "WAN inbound traffic forwarded to LAN"
        enable-default-log
        rule 10 {
            action accept
            description "Allow established/related sessions"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    ipv6-name WANv6_LOCAL {
        default-action drop
        description "WAN inbound traffic to the router"
        enable-default-log
        rule 10 {
            action accept
            description "Allow established/related sessions"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
        rule 30 {
            action accept
            description "Allow IPv6 icmp"
            protocol ipv6-icmp
        }
        rule 40 {
            action accept
            description "allow dhcpv6"
            destination {
                port 546
            }
            protocol udp
            source {
                port 547
            }
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name WAN_IN {
        default-action drop
        description "WAN to internal"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action accept
            description RTP
            destination {
                address 192.168PBX box IP
                port 10000-25000
            }
            log disable
            protocol udp
        }
        rule 21 {
            action accept
            description "Asterisk 5060"
            destination {
                address 192.168PBX box IP
                port 5060
            }
            log disable
            protocol udp
            source {
                group {
                    address-group PBX
                }
                port 5060
            }
        }
        rule 22 {
            action accept
            description httpd
            destination {
                address 192.168.httpd apache server
                port 8080
            }
            log disable
            protocol tcp
        }
        rule 50 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN to router"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        address dhcp
        description Internet
        duplex auto
        firewall {
            in {
                ipv6-name WANv6_IN
                name WAN_IN
            }
            local {
                ipv6-name WANv6_LOCAL
                name WAN_LOCAL
            }
        }
        speed auto
    }
    ethernet eth1 {
        description Local
        duplex auto
        speed auto
    }
    ethernet eth2 {
        description Local
        duplex auto
        speed auto
    }
    ethernet eth3 {
        description Local
        duplex auto
        speed auto
    }
    ethernet eth4 {
        description Local
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    loopback lo {
    }
    switch switch0 {
        address 192.168.1.1/24
        description Local
        mtu 1500
        switch-port {
            interface eth1 {
            }
            interface eth2 {
            }
            interface eth3 {
            }
            interface eth4 {
            }
            vlan-aware disable
        }
    }
}
port-forward {
    auto-firewall enable
    hairpin-nat enable
    lan-interface eth1
    rule 1 {
        description RTP
        forward-to {
            address 192.168PBX box IP
            port 10000-25000
        }
        original-port 10000-25000
        protocol udp
    }
    rule 2 {
        description "Asterisk 5060"
        forward-to {
            address 192.168PBX box IP
            port 5060
        }
        original-port 5060
        protocol udp
    }
    rule 3 {
        description httpd
        forward-to {
            address 192.168.httpd apache server
            port 8080
        }
        original-port 8080
        protocol tcp
    }
    wan-interface eth0
}
service {
    dhcp-server {
        disabled false
        hostfile-update disable
        shared-network-name LAN {
            authoritative enable
            subnet 192.168.1.0/24 {
                default-router 192.168.1.1
                dns-server 192.168.1.1
                lease 86400
                start 192.168.1.38 {
                    stop 192.168.1.243
                }
                static-mapping Asterisk {
                    ip-address 192.168PBX box IP
                    mac-address xx:xx:xx:xx:xx:xx
                }
                static-mapping FreeNAS {
                    ip-address 192.168.fileserver
                    mac-address xx:xx:xx:xx:xx:xx
                }
            }
        }
        static-arp disable
        use-dnsmasq disable
    }
    dns {
        forwarding {
            cache-size 150
            listen-on switch0
        }
    }
    gui {
        http-port 80
        https-port 443
        older-ciphers enable
    }
    nat {
        rule 5010 {
            description "masquerade for WAN"
            outbound-interface eth0
            type masquerade
        }
    }
    ssh {
        port 22
        protocol-version v2
    }
    unms {
    }
}
system {
    analytics-handler {
        send-analytics-report false
    }
    conntrack {
        timeout {
            udp {
                other 60
                stream 360
            }
        }
    }
    crash-handler {
        send-crash-report false
    }
    host-name EdgeRouter-X-5-Port
    login {
        user guest {
            authentication {
                encrypted-password ****************
                plaintext-password ****************
                public-keys guest@tatooine {
                    key ****************
                    type ssh-rsa
                }
            }
            level admin
        }
    }
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
    offload {
        hwnat enable
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone UTC
}

HI

Has anyone tried using an EF Core and an EdgeRouter for a WISP?

I'm trying or I want to use a EF Core as a firewall and let the EdgeRouter handle all the routing, since the UDM or UniFi has problems with routing and the EdgeRouter is more advanced.

...or any better suggestions you might have?

I'm all ears.

I'm setting up a home automation project (Home Assistant + VLAN to isolate my IoT devices) and I'm planning to switch to Bouygues Telecom (a French ISP) with an external ONT, so I can plug my own router directly into the fiber.

I found a used EdgeRouter 12 (ER-12) for about 60€ and I'm wondering if it's a good fit for my use case, specifically:

1) VLAN tagging (VLAN ID 100) + PPPoE for the internet connection

2) Keeping the Bouygues TV set-top box working (requires VLAN + IGMP Proxy for multicast IPTV)

I've found confirmation that a UniFi Dream Machine works fine for this exact setup with Bouygues (Internet + Phone + TV all working), but I haven't found anything specific to the EdgeRouter line with this ISP.

On the technical side, I came across a guide for a UK ISP (BT/EE) using an EdgeRouter X, where the author had to manually assign an IP address to the underlying Ethernet interface (in addition to the PPPoE interface) for the IGMP Proxy to start correctly. Has anyone run into a similar issue, or does the ER-12 handle VLAN + PPPoE + IGMP Proxy smoothly out of the box?

Any experience, tips, or gotchas would be greatly appreciated. Thanks in advance!

Hi, I'm using Edgerouter to manage several clients and I'm balancing 6 different ISPs.

I'm trying to give a client to a specific WAN (always the same).

Right now I have identified this client and added to a static MAC/ IP mapping.

But don't know how exactly send him through always the same ETH port through CLI commands.

Thanks in advance.

@UI-Team

In the other Edgerouters I believe we can use the switch0 to accomplish this bridging, but is this possible in the ER-8-XG somehow? I don't believe the switch0 is available in this model.

When I reboot my EdgeRouter, the snmp service section is not restored at all.

Here is the output of show configuration commands, when it's working (pre-reboot).

set service snmp v3 engineid ''
set service snmp v3 group readonly mode ro
set service snmp v3 group readonly seclevel priv
set service snmp v3 group readonly view DefaultRead
set service snmp v3 user <secret hidden> auth encrypted-key <secret hidden>
set service snmp v3 user <secret hidden> auth plaintext-key <secret hidden>
set service snmp v3 user <secret hidden> auth type sha
set service snmp v3 user <secret hidden> engineid ''
set service snmp v3 user <secret hidden> group readonly
set service snmp v3 user <secret hidden> mode ro
set service snmp v3 user <secret hidden> privacy encrypted-key <secret hidden>
set service snmp v3 user <secret hidden> privacy plaintext-key <secret hidden>
set service snmp v3 user <secret hidden> privacy type aes
set service snmp v3 view DefaultRead oid 1

It turns out `set service snmp v3 group readonly view DefaultRead` must be done AFTER `set service snmp v3 view DefaultRead oid 1`. I suppose that's what prevent the restore from working at reboot ?

You must create "DefaultRead" view first

Value validation failed
Set failed

Version: 2.0.9-hotfix7 (will upgrade to 3.0.1 soon, but I haven't seen any bugfix related to snmp in the 3.x.x changelogs).

Also, there is a chown error:

commit;save
[ service snmp v3 ]
chown: unknown user snmp

Saving configuration to '/config/config.boot'...

Best regards

I run an IT company and, like a lot of people here, I have a decent number of EdgeSwitches in the field. They work perfectly. They're not broken, they're not slow, and for the sites they sit in nobody needs 2.5G or PoE++. The only thing wrong with them is that they live in a different management world than everything else we deploy today.

That's the problem I'd like to put forward — and I'm clearly not the first, which is part of the point.

This question keeps coming back

A few of the existing threads on this community:

• Install UniFi Switch firmware on Edge Switch — https://community.ui.com/questions/Install-UniFi-Switch-firmware-on-Edge-Switch/a81b0ac6-faca-474c-a6b1-100d6095928a
• Unifi Switch Firmware on EdgeSwitch? — https://community.ui.com/questions/dd9a405d-3699-46ea-a9b3-7c7cb26e6ac2
• can you convert an edge switch to a unifi switch? — https://community.ui.com/questions/can-you-convert-an-edge-switch-to-a-unifi-switch/65e2ffe7-2376-4d97-8f1c-992c88aba0d2

The same question, asked independently, more than once, never with a resolution. That's usually a signal of unmet demand rather than a handful of people being awkward.

What changed

We now standardise on UniFi OS consoles. New sites are UniFi end to end, and the single pane of glass is genuinely one of the strongest reasons to keep buying Ubiquiti. But every site with a legacy EdgeSwitch forces us to either run UISP alongside UniFi just for one or two devices, or accept a blind spot in the topology view — a switch that carries real traffic but shows up as an unmanaged black box. Neither is great, and the blind spot is the one that costs us time on every support call.

What I'm asking for

Not a free unlock, and not an unsupported hack. Something official and paid:

• A conversion request tied to a specific device — MAC address and serial number.
• Ubiquiti validates that the model has a supported UniFi equivalent, then generates a signed firmware image bound to that one device.
• A small per-device fee. Speaking for myself, a handful of dollars per switch is an easy yes, and I suspect I'm not alone.
• One-way, clearly documented: converted device is sold as-is, no RMA, support scope limited to what a comparable UniFi switch gets.

Restricting it to the model pairs that already share hardware would keep the scope small. Nobody's asking for every EdgeSwitch ever made.

In our case these will be the models that also reside on the UniFi Line; ES-24-Lite - ES-24-PoE-250W - ES-48-Lite - ES-48-500W - ES-48-750W - ES-8-150W - ES-16-150W - ES-16-XG

Why this is good for Ubiquiti, not just for us

• It's revenue on hardware that was already sold and is currently generating none.
• It keeps us in the ecosystem. The alternative path for a lot of people isn't buying replacement USWs — it's leaving the switch in place, staying half-managed, and slowly getting comfortable with looking at other vendors.
• It sells more UniFi OS consoles and pulls whole sites onto UniFi that are currently stuck in between.
• It's a straightforward sustainability win: working hardware stays in service instead of being replaced for a management-layer reason.

On the DIY route

People have tried, and it doesn't work. The most thorough attempt I've seen is documented outside this community (Level1Techs, "Help convert Ubiquiti Edgeswitch to Unifi?"), on a hardware pair that is identical down to the bootloader build and CPU. The UniFi image boots, but the switch driver and the network interface never come up, because the board identity doesn't resolve to a known UniFi profile.

That's not something the community can or should engineer around. It's exactly the kind of thing only Ubiquiti can do properly, safely, and with a signed image — which is why I'd rather pay for it than watch people keep bricking switches attempting it.

Would be very interested to hear from others running mixed EdgeSwitch / UniFi estates, and from anyone at Ubiquiti on whether this has ever been considered.

• Hardware: EdgeRouter Infinity
• Firmware: 2.0.9 hotfix 7

I noticed kerberos was being dropped, confirmed by reading the logs.

warning kernel: [dmz2it-default-D]IN=eth1.18 OUT=eth1.21 MAC=74:ac:b9:e1:ab:07:2a:f8:b3:5c:65:04:08:00:45:00:00:34 SRC=10.168.191.100 DST=10.168.11.19 LEN=52 TOS=0x00 PREC=0x00 TTL=126 ID=5241 DF PROTO=TCP SPT=65101 DPT=88 WINDOW=65535 RES=0x00 SYN URGP=0 
warning kernel: [dmz2it-default-D]IN=eth1.18 OUT=eth1.21 MAC=74:ac:b9:e1:ab:07:2a:f8:b3:5c:65:04:08:00:45:00:00:34 SRC=10.168.191.100 DST=10.168.11.19 LEN=52 TOS=0x00 PREC=0x00 TTL=126 ID=5243 DF PROTO=TCP SPT=65102 DPT=88 WINDOW=65535 RES=0x00 SYN URGP=0 
warning kernel: [dmz2it-default-D]IN=eth1.18 OUT=eth1.21 MAC=74:ac:b9:e1:ab:07:2a:f8:b3:5c:65:04:08:00:45:00:00:34 SRC=10.168.191.100 DST=10.168.11.19 LEN=52 TOS=0x00 PREC=0x00 TTL=126 ID=5254 DF PROTO=TCP SPT=65103 DPT=88 WINDOW=65535 RES=0x00 SYN URGP=0 
warning kernel: [dmz2it-default-D]IN=eth1.18 OUT=eth1.21 MAC=74:ac:b9:e1:ab:07:2a:f8:b3:5c:65:04:08:00:45:00:00:34 SRC=10.168.191.114 DST=10.168.11.20 LEN=52 TOS=0x00 PREC=0x00 TTL=126 ID=28951 DF PROTO=TCP SPT=47839 DPT=88 WINDOW=65535 RES=0x00 SYN URGP=0

It turns out I have a rule in dmz2it chain that allows Kerberos.

set firewall name dmz2it rule 19 action accept
set firewall name dmz2it rule 19 description 'Allow AD (kerberos)'
set firewall name dmz2it rule 19 destination group address-group ad-srv
set firewall name dmz2it rule 19 destination group port-group kerberos
set firewall name dmz2it rule 19 protocol tcp_udp
set firewall name dmz2it rule 19 source group address-group vpn-employee-networks

set firewall group port-group kerberos port 88
set firewall group address-group vpn-employee-networks address 10.168.190.0/24
set firewall group address-group vpn-employee-networks address 10.168.191.0/24
set firewall group address-group ad-srv address 10.168.11.19
set firewall group address-group ad-srv address 10.168.11.20

For now I just set the default action of the chain to accept.

Am I missing something ?

EDIT: rebooting the router fixed the issue.

The issue was caused by iptables being "broken". A rule was still referencing a deleted adress-group and a deleted port-group (I don't know how it's possible). Deleting the rule was impossible, even after re-creating the missing address and port groups.

Thank you,

I noticed yesterday my UISP self hosted server wasn't responding and when logging into the VM console, I was prompted with the (initramfs) prompt stating that the file system check of root failed requiring a manual fsck.

I ran FSCK -yf /dev/mapper/<drive name> The results are that various free inodes were fixed with a resulting message that the file system was modified. I exit and let the system finish booting. I went to the login prompt, logged in to the console. So far everything looked good. I did NOT run apt yet so as not to introduce additional variables in.

I go and load my webpage/domain and it indefinitely sits at "Application Loading - Please wait" until the page errors out.

I did attempt to upgrade APT files on a previous backup I restored and then reinstalled UNMS, but that resulted in the unms-api docker failing each and every time along with seeing docker mis-match errors relating to docker 29 was found, but Docker 27.5.1 was expected.

I restored another pure backup and this time did NOT run the UNMS/UISP reinstall and have only FSCK'd the file system. Where should I go from here? The UISP page still errors out after several minutes of Application Loading - Please wait.

Something caused this that is well outside my 7 day backup window so going to the furthest back backup still had the same errors as backups from 1-2 days ago.

This is a personal UISP server, not business. I have my own and family/friends UISP devices (about a dozen) in there that I would like to save that data if at ALL possible. Whether fixing the current server or retrieving the backups internally and applying them to a new spun up VM.

Please help!

---

**Environment**

- Hardware: ERX and ERX-SFP tested

- Firmware: v3.0.1 (also reproduced on v2.0.9-hotfix.7; worked correctly on v1.10.11)

- Config: dual-WAN, eth0 = primary (distance 1), eth1 = secondary/failover-only (distance 10), `lb-local enable`, `lb-local-metric-change enable`

**The obvious error — `show ip route` still selects the dead primary route:**

```

IP Route Table for VRF "default"
S *> 0.0.0.0/0 [1/0] via 10.10.10.1, eth0
S  0.0.0.0/0 [10/0] via 10.20.20.1, eth1
...
Gateway of last resort is not set

```

Note the `*>` (selected/FIB route) is still on eth0's distance-1 route, even though watchdog/status below confirm eth0 is down and eth1 is the only reachable path.

**`ip route` (kernel FIB) confirms the same — default still points at the dead interface:**

```

default via 10.10.10.1 dev eth0 proto zebra

```

**`show load-balance watchdog` — eth0 is confirmed down, eth1 confirmed reachable:**

```

Group WAN-LB
 eth0
 status: Waiting on recovery (0/3)
 pings: 155
 fails: 155
 run fails: 0/5
 route drops: 0
 ping gateway: 8.8.8.8 - DOWN


 eth1
 status: OK
 pings: 196
 fails: 1
 run fails: 0/5
 route drops: 0
 ping gateway: 8.8.8.8 - REACHABLE

```

**`show load-balance status` — WLB itself has correctly failed over (weight 0% / 100%), but this isn't reflected in the RIB above:**

```

Group WAN-LB
 Balance Local : true
 Lock Local DNS : false
 Conntrack Flush: true
 Sticky Bits : 0x00000000


 interface : eth0
 reachable : false
 status  : inactive
 gateway  : 10.10.10.1
 route table : 201
 weight  : 0%
 fo_priority : 100
 flows
  WAN Out : 0
  WAN In : 3
  Local ICMP: 346
  Local DNS : 0
  Local Data: 0

 interface : eth1
 reachable : true
 status  : active
 gateway  : 10.20.20.1
 route table : 202
 weight  : 100%
 fo_priority : 60
 flows
  WAN Out : 0
  WAN In : 18
  Local ICMP: 197
  Local DNS : 0
  Local Data: 139

```

**Relevant config:**

```

 group WAN-LB {
  interface eth0 {
   route-test {
    count {
     failure 5
     success 3
    }
    initial-delay 180
    interval 5
    type {
     ping {
      target 8.8.8.8
     }
    }
   }
  }
  interface eth1 {
   failover-only
   route {
   }
   route-test {
    count {
     failure 5
     success 3
    }
    initial-delay 120
    interval 5
    type {
     ping {
      target 8.8.8.8
     }
    }
   }
  }
  lb-local enable
  lb-local-metric-change enable
 }

```

**Impact (highest severity first):**

1. **Site-to-site VPN tunnels back to our office do not form correctly over the surviving WAN** when the primary fails — this is the most serious consequence, since it directly breaks our office connectivity, not just diagnostics.

2. With eth0 down, I cannot ping any public IP from the CLI on the router itself.

3. My own connectivity-monitoring scripts running locally on the router lose all reachability for the duration of the outage.

This is a basic dual-WAN failover use case, not an edge case, and all three of the above worked correctly on 1.10.11.

**Questions for the @UI-Team / community**

1. Has the internal implementation of `lb-local-metric-change` changed between 1.10.x and 2.0.x/3.0.x? On 3.0.1 it does not appear to alter the main table's route distance at all, despite WLB itself correctly detecting the failure and failing over forwarded traffic.

2. Does `failover-only` on the secondary interface change how `lb-local-metric-change` is supposed to behave? My config has it set on eth1 (see config above) — wondering if that's interacting with this.

3. Is there a supported way to get locally-originated traffic (including router-initiated VPN tunnels) to follow WAN failover on 3.0.1 given this doesn't currently work as documented?

4. Has anyone else reproduced this on 2.x/3.x, or is there a known workaround (e.g. transition-script based) — particularly one that reliably re-homes VPN tunnels onto the surviving WAN?

Happy to provide additional sanitized output or run specific diagnostics if it helps track this down. This is currently affecting production office connectivity and monitoring, so any guidance is much appreciated.

Windows 11 Pro Laptop (24H2) -> IW HD (6.5.1) -> USW Pro 48 PoE (7.5.2) -> ER4 (3.0.1) [DHCP server] -> Motorola cable modem -> Comcast/Xfinity Internet

There is also a UCK G2 Plus (5.1.15) running Network (10.4.57).

When the issue starts, the Windows 11 laptop loses internet connectivity. Restarting the laptop does not fix the issue, but randomly it eventually starts to work again which takes minutes to hours.

During the time of losing the internet connection, the laptop still receives an IP address from the ER4 DHCP, but cannot ping nor access the ER4. The laptop can, though, ping and access any other device on the network, including the switch, AP, the cloud key, a Synology DS716, etc. All network devices are on the same subnet. Another Windows 11 Pro laptop exhibits the same issue. Other devices, including android phones, iPhones and iPads, do not have the issue and connect just fine.

When the laptop connection is working normally, ping responses and access to the ER4 is normal, including to all the other devices on the network.

Has anyone come across this or have suggestions on where to begin with the troubleshooting?