Skip to content
MikroTik RouterOS Docs

Virtual Routing and Forwarding (VRF)

Virtual Routing and Forwarding (VRF)

Section titled “Virtual Routing and Forwarding (VRF)”

TL;DR (Quick Start)

Section titled “TL;DR (Quick Start)”

For the impatient: isolate an interface into its own routing domain.

# Create VRF and assign interface
/ip vrf add name=customer1 interfaces=ether2


# Add IP address (automatically uses VRF's routing table)
/ip address add address=192.168.100.1/24 interface=ether2


# Verify VRF routes
/ip route print where routing-table=customer1

Overview

Section titled “Overview”

What this does: Virtual Routing and Forwarding (VRF) creates multiple independent routing tables on a single router. Each VRF operates as if it were a separate router, with its own routing table, interfaces, and forwarding decisions. Traffic in one VRF cannot reach another VRF unless explicitly configured (route leaking).

When to use this:

  • Service provider networks - Isolate customer traffic on shared infrastructure
  • Multi-tenant environments - Separate routing for different clients
  • Management networks - Isolate management traffic from production
  • Overlapping IP spaces - Support multiple networks using the same address ranges
  • BGP/MPLS VPNs - L3VPN implementation with route distinguishers

Prerequisites:

  • RouterOS 7.0 or newer (v6 uses different routing-mark approach)
  • Understanding of routing tables and IP addressing
  • For BGP VPN: BGP package and MPLS configuration

7.14 Firewall Changes

RouterOS 7.14 introduced significant changes to how VRFs interact with firewalls. When interfaces are added to a VRF, firewall rules must reference the VRF virtual interface instead of individual physical interfaces. Review the Firewall Integration section if upgrading.

Key Concepts

Section titled “Key Concepts”

VRF vs Routing Table

Section titled “VRF vs Routing Table”

In RouterOS, creating a VRF automatically creates a corresponding routing table with the same name. The VRF defines which interfaces belong to the isolated network domain, while the routing table holds the routes for that domain.

Route Distinguisher (RD)

Section titled “Route Distinguisher (RD)”

For BGP/MPLS VPN configurations, the Route Distinguisher makes routes globally unique even when IP prefixes overlap between VRFs. Format: ASN:number or IP:number (e.g., 65000:1 or 10.0.0.1:1).

Route Targets (RT)

Section titled “Route Targets (RT)”

Control which routes are imported/exported between VRFs in BGP VPN configurations. Import RT determines which routes a VRF accepts; export RT tags routes leaving a VRF.

Configuration Steps

Section titled “Configuration Steps”

Step 1: Create a VRF Instance

Section titled “Step 1: Create a VRF Instance”
/ip vrf add name=customer1 interfaces=ether2,ether3

This creates:

  • A VRF named “customer1”
  • Associates ether2 and ether3 with this VRF
  • Automatically creates a routing table named “customer1”

Step 2: Verify VRF Creation

Section titled “Step 2: Verify VRF Creation”
/ip vrf print

Expected Output:

Flags: X - disabled
 #   NAME        INTERFACES
 0   customer1   ether2,ether3

Step 3: Check Routing Table Created

Section titled “Step 3: Check Routing Table Created”
/routing table print

Expected Output:

 #   NAME        FIB
 0   main
 1   customer1

Step 4: Add Routes to the VRF

Section titled “Step 4: Add Routes to the VRF”

Routes for VRF interfaces are automatically added to the VRF’s routing table. To add static routes:

/ip route add dst-address=10.0.0.0/24 gateway=192.168.1.1 routing-table=customer1

Step 5: Verify Routes in VRF

Section titled “Step 5: Verify Routes in VRF”
/ip route print where routing-table=customer1

Common Configuration Scenarios

Section titled “Common Configuration Scenarios”

Scenario 1: Basic VRF Isolation

Section titled “Scenario 1: Basic VRF Isolation”

Isolate two customer networks on the same router:

# Create VRFs
/ip vrf add name=customer1 interfaces=ether2
/ip vrf add name=customer2 interfaces=ether3


# Add addresses (each in its own VRF context)
/ip address add address=192.168.1.1/24 interface=ether2
/ip address add address=192.168.1.1/24 interface=ether3


# Note: Same IP range works because they're in different VRFs

Scenario 2: VRF with Internet Access (Route Leaking)

Section titled “Scenario 2: VRF with Internet Access (Route Leaking)”

Provide internet access to a VRF using the main routing table’s default gateway:

# Create VRF
/ip vrf add name=customer1 interfaces=ether2


# Add customer gateway address
/ip address add address=192.168.100.1/24 interface=ether2


# Add default route that resolves in main table (note @main)
/ip route add dst-address=0.0.0.0/0 gateway=10.0.0.1@main routing-table=customer1


# Configure NAT for customer traffic
/ip firewall nat add chain=srcnat out-interface=ether1-wan action=masquerade

Key syntax: gateway=IP@table specifies which routing table resolves the gateway.

Scenario 3: VRF with DHCP Server

Section titled “Scenario 3: VRF with DHCP Server”

Run a DHCP server within a VRF:

# Create VRF and assign interface
/ip vrf add name=customer1 interfaces=ether2


# Add IP address
/ip address add address=192.168.100.1/24 interface=ether2


# Create DHCP pool
/ip pool add name=customer1-pool ranges=192.168.100.100-192.168.100.200


# Configure DHCP server (uses VRF automatically via interface)
/ip dhcp-server add name=customer1-dhcp interface=ether2 address-pool=customer1-pool


# Add DHCP network
/ip dhcp-server network add address=192.168.100.0/24 gateway=192.168.100.1 dns-server=8.8.8.8

Scenario 4: BGP VPN with Route Distinguisher

Section titled “Scenario 4: BGP VPN with Route Distinguisher”

For MPLS L3VPN configurations:

# Create VRF with route distinguisher
/ip vrf add name=customer1 interfaces=ether2


# Configure route distinguisher and targets
/ip route vrf
add vrf=customer1 route-distinguisher=65000:1 \
    import-route-targets=65000:1 export-route-targets=65000:1

Scenario 5: Services Bound to VRF

Section titled “Scenario 5: Services Bound to VRF”

Bind services to listen on specific VRF:

# DNS server in VRF
/ip dns set servers=8.8.8.8 vrf=customer1


# SSH listening on VRF
/ip service set ssh address=0.0.0.0/0 vrf=customer1


# Or use @vrf syntax for one-off operations
/tool fetch url="http://example.com" vrf=customer1

Firewall Integration

Section titled “Firewall Integration”

RouterOS 7.14+ Changes

Section titled “RouterOS 7.14+ Changes”

Starting with RouterOS 7.14, when interfaces are added to a VRF, a virtual VRF interface is automatically created. Firewall rules must reference this VRF interface instead of individual physical interfaces.

Before 7.14:

# Matched individual interfaces in VRF
/ip firewall filter add chain=input in-interface=ether2 action=accept

After 7.14:

# Must match VRF virtual interface
/ip firewall filter add chain=input in-interface=customer1 action=accept

Matching Specific Interfaces Within VRF

Section titled “Matching Specific Interfaces Within VRF”

To match specific physical interfaces within a VRF (7.14+), use connection marking:

# Mark connections from specific interface
/ip firewall mangle add chain=prerouting in-interface=ether2 action=mark-connection new-connection-mark=from-ether2


# Then filter based on connection mark
/ip firewall filter add chain=forward connection-mark=from-ether2 action=accept

NAT with VRF

Section titled “NAT with VRF”
# Masquerade traffic from VRF going to internet
/ip firewall nat add chain=srcnat out-interface=ether1-wan src-address=192.168.100.0/24 action=masquerade

Verification

Section titled “Verification”

Check 1: Verify VRF Configuration

Section titled “Check 1: Verify VRF Configuration”
/ip vrf print

Expected: VRF listed with correct interfaces.

Check 2: Verify Routing Tables

Section titled “Check 2: Verify Routing Tables”
/routing table print

Expected: Each VRF has a corresponding routing table.

Check 3: Check Routes in VRF

Section titled “Check 3: Check Routes in VRF”
/ip route print where routing-table=customer1

Expected: Routes specific to the VRF, including connected routes for assigned interfaces.

Check 4: Test Connectivity from VRF

Section titled “Check 4: Test Connectivity from VRF”
/ping 8.8.8.8 vrf=customer1

Expected: Successful if VRF has internet access configured.

Check 5: Verify Interface Assignment

Section titled “Check 5: Verify Interface Assignment”
/ip address print detail where interface=ether2

Expected: Shows actual-interface reflecting VRF membership.

Troubleshooting

Section titled “Troubleshooting”
SymptomCauseSolution
Routes not active in VRFGateway looking in wrong routing tableUse gateway=IP@main to specify table for gateway resolution
VRF interface not in firewall list (7.14+)7.14 changed interface behaviorUse VRF name as interface: in-interface=customer1
Services not accessible in VRFService not bound to VRFConfigure vrf= parameter on service
Overlapping addresses conflictingInterface not in VRF when address addedCreate VRF before adding IP addresses
Wrong VRF matchedVRF matching is top-to-bottomReorder VRFs with /ip vrf move
Firewall rules broken after 7.14 upgradeInterface matching changedUse VRF virtual interface or connection marks
Ping fails from VRFTool using main tableSpecify VRF: /ping 8.8.8.8 vrf=customer1

Debug: Gateway Resolution

Section titled “Debug: Gateway Resolution”

If routes show inactive, check gateway resolution:

# Wrong - gateway looks in customer1 table where it doesn't exist
/ip route add dst-address=0.0.0.0/0 gateway=10.0.0.1 routing-table=customer1


# Right - gateway explicitly resolves in main table
/ip route add dst-address=0.0.0.0/0 gateway=10.0.0.1@main routing-table=customer1

Debug: VRF Order

Section titled “Debug: VRF Order”

Check current VRF order:

/ip vrf print

Move specific VRF to top for priority matching:

/ip vrf move [find name=specific-vrf] destination=0

Common Mistakes

  • Forgetting @table for gateway resolution - Use gateway=10.0.0.1@main when the gateway is in a different routing table
  • Adding address before VRF assignment - Always create VRF and assign interface first, then add IP addresses
  • Using physical interface in firewall (7.14+) - After 7.14, use VRF name (in-interface=customer1) not physical interface
  • Expecting automatic NAT isolation - NAT rules must explicitly reference VRF source addresses
  • Not specifying VRF for diagnostic tools - Use vrf= parameter: /ping 8.8.8.8 vrf=customer1
  • Assuming services automatically use VRF - Most services require explicit vrf= configuration

Services with VRF Support

Section titled “Services with VRF Support”
ServiceVRF ParameterNotes
BGPPer-connectionFull VRF support
OSPFvrfPer-instance
DNSvrfClient and server
DHCP RelayvrfAdded in 7.15
SSH/Telnet/WWWvrfVia /ip service
NTPvrfClient and server
SNMPvrf
RADIUSvrf
Ping/TraceroutevrfDiagnostic tools
FetchvrfHTTP client
NetwatchvrfMonitoring

Limitations

Section titled “Limitations”
  • Maximum 1024 VRF instances (routing table limit)
  • Not all services support VRF (check documentation)
  • VRF order matters - matching is top-to-bottom
  • RouterOS 7.14+ changed firewall interface matching behavior
  • Some features require specific RouterOS versions for VRF support
Section titled “Related Topics”

Routing

Section titled “Routing”

Network Services

Section titled “Network Services”

Security

Section titled “Security”

Reference

Section titled “Reference”

VRF Properties (/ip vrf)

Section titled “VRF Properties (/ip vrf)”
PropertyTypeDefaultDescription
namestring-VRF identifier (also becomes routing table name)
interfaceslist-Interfaces assigned to this VRF
disabledyes/nonoDisable VRF

Route VRF Properties (/ip route vrf)

Section titled “Route VRF Properties (/ip route vrf)”
PropertyTypeDefaultDescription
vrfstring-VRF name reference
route-distinguisherstring-RD format: ASN:number or IP:number
import-route-targetslist-Route targets to import
export-route-targetslist-Route targets to export

Common VRF Parameters for Services

Section titled “Common VRF Parameters for Services”
ParameterUsageExample
vrf=Specify VRF for service/command/ping 8.8.8.8 vrf=customer1
@tableGateway resolution in specific tablegateway=10.0.0.1@main
routing-table=Target routing table for routesrouting-table=customer1

Commands

Section titled “Commands”
CommandDescription
/ip vrf addCreate new VRF
/ip vrf printList VRF instances
/ip vrf moveReorder VRF (affects matching priority)
/routing table printList all routing tables including VRF tables
/ip route print where routing-table=XShow routes in specific VRF