I have a dual linux firewall/router setup that is connected to 2 different upstream providers. Internally the default route is a failover using vrrp.
The setup looks something like this. The routes are provided to the routers via BGP.
Provider A (x.x.x.57) - Router 1 [WAN](x.x.x.58) [LAN](a.a.a.130/128) +----- VRRP (a.a.a.129/128) [default gw] Provider B (y.y.y.61) - Router 2 [WAN](y.y.y.62) [LAN](a.a.a.131/128)
It all works correctly in general.
However, what I've noticed is that when Router 1 is the master for the VRRP, a.a.a.131 is not able to be pinged from a client that routes through Provider A. Likewise, if Router 2 is the master we cannot ping a.a.a.130. I also cannot ssh to that address. I can however ssh or ping the WAN side of both routers at any time. Since I can reach the WAN interface of Router 2 when Router 1 is the master, and forwarding is turned on, how come I can't directly reach the LAN side of the same router when it's not the master ?
What would be the cause of that?