Networking¶

Networking in OpenStack is handled by Neutron. You build your own private networks, connect them to the outside world through a router, and expose individual instances with floating IP addresses. Security groups act as per-instance firewalls.

Private networks and subnets¶

Create a network and give it a subnet with an address range and DNS:

openstack network create my-project-net
openstack subnet create my-project-subnet \
  --network my-project-net \
  --subnet-range 192.168.10.0/24 \
  --dns-nameserver <resolver-ip>

Instances attached to this network get an address from the subnet range. Traffic between instances on the same network stays internal.

Routers and external connectivity¶

To reach the internet, connect your network to the external (public) network through a router. Find the external network name first:

openstack network list --external

Then create the router and wire it up:

openstack router create my-router
openstack router set my-router --external-gateway <external-network>
openstack router add subnet my-router my-project-subnet

Floating IPs¶

A floating IP is a public address you map onto an instance so it can be reached from outside.

openstack floating ip create <external-network>
openstack server add floating ip my-instance <floating-ip>

Reserve fixed addresses separately from instances

If a service needs a stable address, create the floating IP (or a Neutron port) as its own resource and attach it to the instance, rather than relying on whatever the instance is given. The address is then preserved even if you delete and recreate the instance behind it.

Security groups¶

A security group is a set of firewall rules applied to an instance. The default group usually allows all outbound traffic and only intra-group inbound traffic, so you must open the ports you need. For example, to allow SSH and HTTPS:

openstack security group create web
openstack security group rule create web \
  --proto tcp --dst-port 22 --remote-ip 0.0.0.0/0
openstack security group rule create web \
  --proto tcp --dst-port 443 --remote-ip 0.0.0.0/0

Attach the group when launching the instance with --security-group web, or add it later:

openstack server add security group my-instance web

Restrict --remote-ip to known networks where you can, rather than opening management ports such as SSH to the whole internet.