Why can't I reach the LAN side of a slave vrrp router?

Question

I have a dual linux firewall/router setup that is connected to 2 different upstream providers. Internally the default route is a failover using vrrp.

The setup looks something like this. The routes are provided to the routers via BGP.

Provider A (x.x.x.57) - Router 1 [WAN](x.x.x.58) [LAN](a.a.a.130/128)
                                                   +----- VRRP (a.a.a.129/128) [default gw]
Provider B (y.y.y.61) - Router 2 [WAN](y.y.y.62) [LAN](a.a.a.131/128)

It all works correctly in general.

However, what I've noticed is that when Router 1 is the master for the VRRP, a.a.a.131 is not able to be pinged from a client that routes through Provider A. Likewise, if Router 2 is the master we cannot ping a.a.a.130. I also cannot ssh to that address. I can however ssh or ping the WAN side of both routers at any time. Since I can reach the WAN interface of Router 2 when Router 1 is the master, and forwarding is turned on, how come I can't directly reach the LAN side of the same router when it's not the master ?

What would be the cause of that?

Answer 1

To answer my own question. I found the following link about reverse path filtering to be very helpful. In following it's suggestions I managed to fix the problem I was having.

Disabling reverse path filtering in complex networks