VPCs, Subnets and Virtual Machines
A VPC is a logical router together with the subnets attached to it. This page covers creating one, giving it addresses, and putting a virtual machine on it.
Creating a VPC
Go to Network > OVN > VPCs and choose Create VPC. You provide:
- Name — becomes the name of the logical router as well
- Initial subnet — a CIDR, for example
10.50.0.0/24 - Initial router IP — the gateway address inside that subnet, for example
10.50.0.1 - Enable DHCP — whether OVN should serve addresses on this subnet
Creating it produces a logical router, a logical switch for the subnet, the router port that joins them, and DHCP options if you asked for them. All of those remain visible on their own pages.
A VPC name is also a router name, so keep it short and recognisable. You will see it on the Logical Routers page and in the topology view.
Adding more subnets
A VPC can hold several subnets. Create a logical switch, then add a router port on the VPC's router holding the gateway address for that subnet, and a port on the switch of type router pointing at it. Traffic then routes between the subnets through the VPC's router.
One logical switch normally carries one subnet. Two subnets on one switch share a broadcast domain and OVN's DHCP server cannot distinguish them.
Deleting a VPC
Deleting a VPC removes its router, its subnets' logical switches and their DHCP options together, so nothing is left stranded.
If any of its subnets still has workloads attached, Vapor refuses and names them. Detach or delete those workloads first. This is deliberate: deleting the subnet would remove the network from under a running machine.
DHCP
When a subnet has DHCP enabled, OVN answers requests from ports on that switch itself. There is no DHCP server process to run and no relay to configure.
The options served — gateway, DNS servers, lease time — are editable on the DHCP Options page. Several DNS servers may be given, separated by commas:
8.8.8.8, 1.1.1.1For a port to receive a lease, the MAC address OVN has recorded for it must match the MAC the machine actually sends from. Vapor handles this when you attach a virtual machine through the interface dialog. If you create a port by hand, give it the machine's real MAC address rather than letting OVN pick one.
Attaching a virtual machine
Attach an OVN network the same way as any other: in the Add Network Interface dialog, when creating a machine or editing an existing one.
- Choose device type OVN.
- Pick the logical switch from the list.
- Leave automatic DHCP enabled unless you intend to assign a fixed address.
Vapor creates the logical switch port, pins the MAC so OVN and the machine agree, attaches the interface to the host's integration bridge and tags the port so it can be cleaned up later. Removing the interface removes the logical port with it.
Confirming it worked
On the machine's Network tab, an OVN interface shows the logical switch it belongs to, its logical port and whether OVN has bound the port. A NIC attached to a plain OVS bridge shows no OVN details — that is correct, not an omission.
Inside the guest, bring the interface up and request an address. It should receive the address OVN allocated for the port.
Multi-homed guests
A guest with more than one interface may not send traffic out of the OVN one. Linux picks the default route with the lowest metric, so an existing route on another interface usually wins, and traffic that looks like it should leave through the OVN network leaves elsewhere.
If a guest has another network, either give the OVN default route a lower metric or add explicit routes for the destinations that should use it. Symptoms of getting this wrong are misleading: the gateway and same-subnet hosts answer, everything routed does not.
Naming rules
Most OVN objects accept the usual characters, including hyphens. Two do not:
- Port groups
- Address sets
Their names are substituted into firewall rule expressions, where OVN reads a hyphen as subtraction. A port group called web-servers produces a rule that is stored successfully and never applied. Use underscores: web_servers.
Vapor rejects such a name as you type it and explains why. The names must start with a letter or underscore and contain only letters, numbers, underscores and dots.