Routing and External Connectivity
A logical router joins your subnets and, with a little more configuration, connects them to the physical network. This page covers routing between subnets, reaching the outside, and giving workloads a public address.
Everything here lives on the Logical Routers page, or on the VPC that owns the router.
Routing between subnets
Subnets attached to the same router route between each other with no further configuration. Each subnet's gateway is the router port address you gave it, and a workload reaches other subnets through that gateway.
The router's ports are listed on its detail view. Each one shows the subnet it serves and the address it holds there.
Static routes
Add a static route to send traffic for a prefix to a next hop. The common case is a default route out of the VPC:
- IP prefix:
0.0.0.0/0 - Next hop: the address of the physical gateway
A route needs a next hop the router can actually reach, which usually means the router must first have a port on a network that contains it — see below.
Reaching the physical network
A logical router has no path off the virtual network until you give it one. That takes three things:
A provider network mapping. On the host that will carry the traffic,
ovn-bridge-mappingsmust map a provider network name to the OVS bridge holding the physical uplink. This is set during activation, or on the host's OVS configuration.A localnet switch. Create a logical switch, then a port on it of type
localnetwhose network name matches the mapping. This switch is the virtual representation of the physical segment.A router port on that switch. Give the router a port holding an address on the physical subnet, and connect it to the localnet switch with a port of type
router. Pin the router port to a gateway chassis — the host that has the provider mapping — so OVN knows where that traffic should leave.
Then add a default route via the physical gateway.
If you create a localnet port on a host with no matching bridge mapping, Vapor creates it and warns you that the provider network is not defined here. That is not necessarily wrong — the traffic may be intended to leave through a different host — but if egress does not work, this is the first thing to check.
SNAT: sharing one external address
To let a whole subnet reach the internet through a single address, add a NAT rule of type SNAT on the router:
- External IP: the address traffic should appear to come from
- Logical IP: the subnet, for example
10.50.0.0/24
Traffic leaving that subnet is then translated to the external address, and replies are translated back.
Verify the external address is free
An external address must be one nothing else is using. Checking whether it answers a ping is not enough: a firewalled host stays silent and still owns the address. Confirm with an ARP probe from a host on the same segment, or from your address management records.
Claiming an address already in use puts OVN and that host in a conflict for it, breaking both intermittently and in a way that is hard to attribute.
DNAT: publishing one workload
To make a single workload reachable from outside, use DNAT and SNAT with the external address and the workload's internal address. Inbound connections to the external address reach the workload, and its outbound traffic uses the same address.
Routing policies
Policies act before the routing table and are matched by priority, highest first. Use them when the destination alone is not enough to decide — for example sending one subnet's traffic a different way, or dropping traffic between two subnets that share a router.
You can build a policy from source and destination CIDR, protocol and port, or write the match expression directly if you need something the builder does not cover. Actions are allow, drop, and reroute to one or more next hops.
A policy takes effect immediately and is a blunt instrument — a drop on a wide source prefix will stop traffic you did not intend. Add the narrowest match that expresses your intent, and remove the policy to reverse it.
Load balancers belong on a switch
When you attach a load balancer, attach it to the logical switch rather than to a distributed router.
A router-attached load balancer translates the destination on the way in, but on a distributed router with no dedicated gateway port OVN does not generate the reverse translation. Replies then carry the backend's own address instead of the virtual IP, the client rejects them, and every request appears to return nothing. A switch-attached load balancer works correctly.
Related: give a virtual IP an address outside the subnet its clients are on. An address inside the subnet has nothing to answer ARP for it, so clients never get as far as sending a packet — the connection simply hangs. With an off-subnet virtual IP, the client sends to its gateway and the load balancer acts on the way through.