Neutron enables users to build routers that provide connectivity between the networks created by users and external networks. In a reference implementation, the Neutron L3 agent provides IP routing and network address translation for virtual machine instances within a cloud by utilizing network namespaces to provide isolated routing instances. By creating networks and attaching them to routers, users can expose connected virtual machine instances and their applications to the Internet and other remote networks.
Prior to the Juno release of OpenStack, users were limited to building standalone routers that acted as single points of failure in the network stack. Since the advent of distributed virtual routers in Juno and beyond, standalone routers are now referred to as legacy routers.
In previous chapters, we discovered the difference between provider and tenant networks and demonstrated the process of booting an instance and connecting it to a network. In this chapter, we will work through the following:
- Installing and configuring the L3 agent
- Creating an external provider network
- Creating a standalone router in the CLI and Horizon dashboard
- Attaching a router to both external and tenant networks
- Booting instances
- Demonstrating instance and namespace connectivity using LinuxBridge
- Demonstrating SNAT and DNAT functionality provided by floating IPs
In a reference implementation, virtual routers created in Neutron exist as network namespaces that reside on nodes running the neutron-l3-agent service. A virtual router is often connected to a single external provider network and one or more tenant networks. Router interfaces connected to these networks can be identified as:
qg—gateway interfaceqr—router interface
Neutron routers are responsible for providing inbound and outbound connectivity to and from tenant networks through the use of network address translation or NAT. The following diagram shows how a router namespace may be connected to multiple bridges in a LinuxBridge implementation:
Figure 7.1
The preceding diagram demonstrates a Neutron router connected to multiple bridges in a LinuxBridge-based implementation. Traffic from tenant networks is routed in from qr interfaces and out the qg interface onto the external network. Routing tables within the namespace dictate how traffic is routed, and iptables rules dictate how traffic will be translated if necessary.
More information on creating and configuring standalone Neutron routers, along with examples on how they are connected to a network and provide connectivity to instances, can be found later in this chapter.