Related: T2574 (same root cause, closed as Not Applicable on older version)

WLB creates per-interface routing tables with only a default route. Fwmarked LAN traffic is policy-routed to these tables, where internal destinations (BGP, connected, DNATed) have no route and exit via WAN instead of being routed internally.

We run a Kubernetes cluster with Calico BGP peering through VyOS. BGP advertises pod and service CIDRs (10.3.0.0/16, 10.152.184.0/24) to VyOS, which installs them in the main routing table. DNAT hairpin rules forward LAN traffic destined for the WAN public IP to internal ClusterIPs.

When WLB is enabled for WAN failover (eth0 primary, wlan0 backup), all LAN traffic from eth2 gets fwmarked and policy-routed to per-interface tables that only contain a default route. Traffic to BGP-advertised prefixes and DNATed destinations bypasses the main table entirely and exits via the WAN.

set protocols bgp system-as 65000
set protocols bgp peer-group calico remote-as 65414
set protocols bgp listen range 10.2.0.0/24 peer-group calico

set load-balancing wan interface-health eth0 nexthop dhcp
set load-balancing wan interface-health wlan0 nexthop 192.168.169.1
set load-balancing wan rule 1 failover
set load-balancing wan rule 1 interface eth0 weight 10
set load-balancing wan rule 1 interface wlan0 weight 1
set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 protocol all
set load-balancing wan enable-local-traffic

set nat destination rule 110 destination address 23.93.94.243
set nat destination rule 110 translation address 10.152.184.99

ip rule before fix:

0:   from all lookup local
219: from all fwmark 0xc9 lookup 201
220: from all fwmark 0xca lookup 202
32766: from all lookup main

Table 201 contains only: default via 23.93.80.1 dev eth0
BGP routes (10.3.0.0/16, 10.152.184.0/24) exist only in main table and are never consulted for fwmarked traffic.