Skip to content

Routers

A router connects networks. Without one, a VM can only reach other resources on its own network. Attach several networks to a router and they can reach each other; give the router an external gateway and those networks can reach the outside world.

A router belongs to one project and one infrastructure, and can only attach networks on that infrastructure: your project's own networks and networks shared with it. Routers themselves can't be shared.

You manage routers under COMPUTE & NETWORK > Routers.

Create a router

  1. Go to Routers and click Create Router.
  2. Under Where it runs, choose the project and the infrastructure. Optionally give the router a name and description.
  3. Decide whether it needs an External gateway (see below). If so, turn it on and pick the External network.
  4. Click Create Router.

The external gateway is fixed at creation

You can't add, change or remove the external gateway later. If you need a different one, create a new router.

Give networks internet access

A router with an external gateway lets VMs on its attached networks open connections to the outside world, for example to download packages or call external APIs.

The External network list offers external networks on the router's infrastructure that are available to your project: imported into it, or shared with it (marked Shared). You can't create an external network in the platform. If the list is empty, ask your organization administrator to import the cloud's provider network and share it with your project (see External networks). Building the list needs network_list in the project.

For a VM to actually use the router, its network must send traffic to the router: see the next section. Its firewalls must also allow the outbound traffic.

Reaching VMs from outside

The platform doesn't manage floating IPs, so a router gives VMs outbound access only: connections from outside can't reach a VM behind it. To make a VM reachable from outside, attach it directly to a network that is reachable from outside, such as an external network shared with your project, if your cloud allows VMs on it.

Attach networks

  1. Open the router and click Attach Network.
  2. Choose the Network.
  3. Optionally enter a Fixed IP, the router's address on that network.
  4. Click Attach Network.

The network must be on the router's infrastructure, Active or Degraded, and its range must not overlap the router's external network or another network attached to it. A router can attach IPv4 and IPv6 networks.

Make a router the network's gateway

VMs send traffic for other networks to their network's Gateway, set in the network's DHCP settings (by default the first address of the range, such as 10.0.0.1). The router only receives that traffic if its interface holds that address.

  • Enter the network's gateway address as the Fixed IP when you attach the network. The router then becomes the network's default gateway, and VMs on it can reach the other attached networks and, through the external gateway, the outside world.
  • If you leave Fixed IP blank, the cloud gives the router any free address on the network, not the gateway address. VMs won't send traffic through the router unless you add routes on them yourself.

Detach a network

Click the detach button next to the network on the Network Interfaces card and confirm. Routing through that interface stops, and every static route whose next hop is on that network is removed.

Static routes

A router's static routes send traffic for a destination range to a next hop, for example a VPN gateway VM on one of the attached networks. They live on the router. Routes pushed to VMs by DHCP are separate: see DHCP settings.

  1. Open the router and click Add Static Route.
  2. Enter the Destination CIDR (for example 10.20.0.0/24) and the Next Hop address.
  3. Click Add Route.

Rules:

  • Static routes are IPv4 only.
  • The next hop must be inside a network already attached to the router.
  • The destination can't be a network attached to the router (it is already routed), and each destination can have only one route.

Manage a router

From the router's page you can Edit its name and description, attach and detach networks, add and remove static routes, Sync it (re-apply its configuration to your cloud, for example when it is Degraded), and see its Action History.

Changes work while the router is Active or Degraded. In Error you can only delete or detach it. See Resource statuses.

Import an existing router

  1. Make sure the router's external network and every network attached to it are already in the platform and available to the project, imported into it or shared with it. Otherwise the import is refused and names the missing networks.
  2. On the Routers page, click Import Router.
  3. Choose the project and the infrastructure, then the Router in your cloud.
  4. Click Import Router.

The import brings the router's external gateway, network interfaces and static routes. Routers the platform built for Kubernetes clusters aren't offered. Routers the platform created for your own routers, or already imported into the project, can still appear in the list but are refused with an explanation.

On a Read-only router, attaching or detaching networks, changing static routes and Sync aren't available until management is enabled. For Read-only and Managed and taking ownership, see Imported resources.

Delete or detach a router

  • Delete destroys the router, its network interfaces and its static routes, in the platform and in your cloud. The networks themselves are not deleted.
  • Detach removes the router from the platform and leaves it in your cloud with its interfaces and routes. You can import it again later.

Both are in the router's Actions menu, and you confirm by typing the router's name. Imported routers can only be detached until your project takes ownership of them (see Imported Resources).

A router that never finished being created in your cloud can't be detached, because there is nothing in your cloud to leave behind. Delete it instead.

Quotas

Each router, created or imported, uses one routers unit. See Resource Quotas.

Permissions

Task Permission
Create router_create
Import router_import (as Managed: also router_control_update)
Edit name and description router_metadata_update
Attach and detach networks router_network_attachment_update
Add and remove static routes router_routes_update
Sync, cancel an action router_action_update
Switch Read-only / Managed router_control_update
Take ownership router_authority_update
Delete / Detach router_delete / router_detach

router_update includes metadata, network attachment, route and action updates. Picking an external network also needs network_list in the project. The create and import forms also need some organization-level permissions to pick where the router runs: see What project members typically need. Full list: Permissions Reference.