Skip to content

Create an OVN Logical Router

Logical routers connect logical switches together at L3, do NAT to the physical underlay, and are the only correct way to give a tenant network outbound internet.

Quick steps

  1. Networks → OVN → + New Logical Router.
  2. Fill in:
  3. Name — short, lowercase (e.g. tenant-edge).
  4. Tenant (admin only) — leaves the router invisible to other tenants.
  5. Create.

The router is created in OVN's NB DB. It has no ports until you attach a switch to it.

Attach a switch to the router

After creating both the router and a switch:

  1. Networks → OVN → Router row → Attach Switch.
  2. Pick the switch and supply the gateway IP on this router for that subnet (e.g. 10.50.10.1 if the switch's subnet is 10.50.10.0/24).
  3. Attach.

A logical router port (lrp-<switch>-<router>) is created with that IP. Every endpoint on the switch can now reach the gateway. Routing between two switches attached to the same router is automatic — no static routes needed for the tenant-internal case.

North-bound (external) connectivity

For VMs to reach the internet you need to attach the router to a provider network (the underlay):

# From the OVN central host:
ovn-nbctl lr-route-add tenant-edge 0.0.0.0/0 192.168.10.1
ovn-nbctl lr-nat-add  tenant-edge snat 192.168.10.99 10.50.10.0/24

192.168.10.99 is the floating SNAT IP that traffic appears to come from outside; it must be unused on the underlay.

Inspecting a router

ovn-nbctl lr-list                        # all routers
ovn-nbctl lr-route-list tenant-edge      # static routes
ovn-nbctl lr-nat-list   tenant-edge      # NAT entries
ovn-nbctl show                           # full topology

Removing a router

Networks → OVN → router row → Remove. All lrp-* ports are dropped first; the switches that were attached to it lose their gateway and become L2-only islands until reattached to a different router.

See also