~/Rev_
← writeups

ARP Flux on a Dual-NIC VyOS VM: Diagnosis and Fix

The core router was healthy but unreachable on management. The cause was a second virtual NIC on another bridge; one NIC, one bridge fixed it.

2026-01-06#CyberDen
work: Jan 2026 · Resolved · CyberDen, VyOS, Proxmox, Networking

TL;DR

After the rebuild, every host on the management segment could talk to every other host, except VyOS: no ping, no SSH from my laptop. VyOS had the right address, its interfaces were up, and nothing in its firewall blocked me. It had two virtual NICs on two different Proxmox bridges, and only one of those bridges carried the management segment. Removing the extra NIC (net0 on vmbr0) fixed it instantly.

Symptoms

  • Management segment: switch, hypervisors and pfSense all reachable from the laptop
  • VyOS: unreachable, though it had worked briefly before "something changed with the interfaces"
  • On VyOS itself: management IP bound, interface UP, sshd listening, no firewall drops
VyOS cannot reach pfSense
From VyOS: a correct route to pfSense, and every ping still unreachable.

Eliminating VyOS

I checked the router first:

show interfaces        # mgmt IP on the expected interface, state u/u
show configuration     # no firewall on the mgmt interface, ssh service enabled

All correct. If the host is right and the path is wrong, the problem is Layer 2: the Proxmox bridge, VLAN filtering, or which bridge the VM's NIC sits on.

Root cause

In Proxmox, the VyOS VM had:

net0 → vmbr0
net1 → vmbr1

The management segment lived on only one of those bridges. With two interfaces on related L2 domains, Linux doesn't guarantee which interface answers ARP, so VyOS sometimes replied out the wrong interface. That's ARP flux, a split-brain at Layer 2. From the laptop's side, the router just wasn't there.

VyOS with two NICs
Two NICs on VyOS. Only one of them should have been answering for management.

The fix

Removed net0 entirely, leaving one NIC on one bridge carrying the trunk:

  • one NIC
  • one bridge
  • one L2 domain
  • the management address untagged, every other segment as a tagged sub-interface

Ping and SSH worked immediately.

Lessons

  • Router-on-a-stick means one stick. Extra NICs on a router VM are a liability unless each one has a defined, separate job.
  • When the host is innocent, go down a layer.
  • "It worked for a bit" is a clue. Intermittent reachability is often a race between two paths.

Sources: VyOS SSH Troubleshooting (5 Jan 2026)