MPLS · Topic 6 of 7
VRF and Route Leaking
Learn how a VRF gives a router separate routing tables per customer, how route distinguishers and route targets work, and how to leak routes.
- 5 min
- A VRF is a separate routing table that lets customers share a router and overlapping addresses.
- On RouterOS v6,
/ip route vrfcreates one with a routing mark and interfaces. - The route distinguisher makes prefixes unique.
What it is
A VRF is a separate routing table, with its own interfaces, so one router can serve many customers with overlapping addresses.
Two customers can both use 192.168.1.0/24 and never conflict, because each lives in its own table. The main table of the router stays separate from them.
Route leaking is the controlled sharing of selected routes between tables, for example to let a customer reach a shared service.
How it works
Interfaces are bound to a table, routes are tagged with identifiers, and leaking is done on purpose.
Creating a VRF
On RouterOS v6 a VRF is created with a routing mark that names the table, and a list of interfaces that belong to it.
/ip route vrf add routing-mark=cust-a interfaces=ether3 route-distinguisher=65000:1 import-route-targets=65000:1 export-route-targets=65000:1
/ip route print where routing-mark=cust-arouting-marknames the table.interfaceslists the interfaces whose traffic uses the table.- The connected networks of those interfaces appear in the table.
RouterOS v7 replaces the routing mark with a routing table, and VRF configuration is arranged differently. The concept is the same.
A packet that arrives on a VRF interface is looked up only in that table. If the destination is not in the table, the packet is not forwarded, even if the main table has a route.
Route distinguisher and route target
Two identifiers are used when VRF routes are carried between routers.
| Identifier | Job |
|---|---|
| Route distinguisher | Makes a prefix unique, so overlapping customer prefixes can share one BGP session |
| Route target | Controls which VRFs import and export a route |
The route distinguisher does not decide who sees a route. The route target does. A VRF exports its routes with its export targets, and imports only routes whose targets match its import targets.
Leaking between VRFs
Route targets control which VRFs import routes that are carried through BGP. If VRF A imports a target that VRF B exports, B routes can appear in A. For a simple leak on one router, the static route method in the next section is the direct one.
/ip route vrf add routing-mark=cust-a interfaces=ether3 route-distinguisher=65000:1 import-route-targets=65000:1,65000:99 export-route-targets=65000:1
/ip route vrf add routing-mark=shared interfaces=ether4 route-distinguisher=65000:99 import-route-targets=65000:99 export-route-targets=65000:99In this example, A lists the shared target as an import, so it can learn the shared routes when they are carried through BGP. The shared VRF does not import A, so it has no return route to A. A leak needs to work in both directions for two way traffic, so the shared VRF would need to import A as well.
Leaking with a static route
On RouterOS v6 a route in one table can point to a gateway that is resolved in another table. The gateway is written with an at sign and the table name.
/ip route add dst-address=0.0.0.0/0 gateway=192.0.2.1@main routing-mark=cust-a
/ip route add dst-address=192.168.1.0/24 gateway=10.10.10.2@cust-a- The first route lets the customer table use a gateway that is reachable in the main table.
- The second route, in the main table, reaches back into the customer table.
Both directions are needed. A one way leak delivers the packet, but the reply cannot find its way back.
When a leaked path fails, check the return route first. One way leaks are the usual cause.
Checking a table
/ip route print where routing-mark=cust-aThe output lists only the routes of that table. Compare it with the main table, which is shown without a filter.
What to remember for the exam
Seven facts cover most questions here.
- A VRF is a separate routing table that lets customers share a router and overlapping addresses.
- On RouterOS v6,
/ip route vrfcreates one with a routing mark and interfaces. - The route distinguisher makes prefixes unique.
- The route target decides which VRFs import and export routes.
- Leaking can use matching route targets, or a static route with a gateway in another table.
- A gateway in another table is written as
address@tableon RouterOS v6. - A leak must be done in both directions for return traffic to work.
A VRF does not see the main table by default. A missing route in the VRF means no forwarding, even if the main table has one.
Common mistakes
These four errors are common.
Expecting the VRF to use the main table. Each table is isolated, so a default route must be added or leaked.
Treating the route distinguisher as a policy tool. It only makes prefixes unique, and the route target controls visibility.
One way leaks. The traffic arrives, but replies are lost.
Reusing the same route target for unrelated customers. The customers then import each other's routes.
Check yourself
Work through these three questions.
What does the route target do that the route distinguisher does not?
The route target controls which VRFs import and export a route. The route distinguisher only makes a prefix unique.
How can a static route in a VRF use a gateway that is in the main table?
On RouterOS v6, the gateway is written with an at sign and the table name, for example
gateway=192.0.2.1@main.Why must a route leak work in both directions?
A one way leak lets the packet through, but the reply has no route back to the sender.
Topic 6 of 7 in MPLS
Test yourself on MPLS
The full MikroTik MTCINE question bank has 475 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.