OpenStack Networking Guide: How Neutron Works

This guide explains how OpenStack networking works, focusing on Neutron, the component that manages networks, subnets, and routers. You’ll learn the core concepts, how to set up basic and advanced networking, and how to troubleshoot common issues, so you can design a cloud network that meets your needs.

What Is OpenStack Networking?

OpenStack Networking (code-named Neutron) is the service that provides “network connectivity as a service” between interface devices (e.g., vNICs) managed by other OpenStack services. It gives tenants (users or projects) self-service control over their network resources: they can create networks, subnets, ports, routers, and security rules through the API or dashboard, without involving a physical network administrator. Neutron supports a wide range of plugins and agents, allowing it to work with simple Linux bridges, Open vSwitch, or commercial SDN controllers.

Before Neutron (in the early Nova-only days), networking was flat and static; every instance shared the same bridge, and IP assignment was manual. Neutron introduced a pluggable architecture that decouples the API from the backend implementation, so the same API can drive a simple flat network or a complex VXLAN overlay with distributed routing.

Core Concepts: Networks, Subnets, and Ports

Neutron’s data model is built around three primary objects:

• Network – an isolated L2 segment. It can be flat (mapped to a physical VLAN), VLAN-tagged, or tunneled (VXLAN/GRE). A network has a name, a project owner, and a set of subnets.
• Subnet – a block of IP addresses (CIDR) associated with a network. It defines the IP version (IPv4/IPv6), allocation pools, DNS servers, and gateway IP. Neutron allocates IPs from this pool to ports.
• Port – a virtual connection point, usually a vNIC attached to an instance. A port has a MAC address and one or more IP addresses (fixed and floating). Security groups and QoS policies are applied at the port level.

When you boot an instance, Nova asks Neutron for a port on a specified network. Neutron picks an available IP from the subnet’s allocation pool, creates the port, and the instance’s vNIC is attached to it. The port’s IP is what the instance sees as its primary IP.

How Neutron Implements Networking: Agents and Plugins

Neutron itself is an API server that stores state in a database. The actual data-plane work is done by agents running on compute nodes and network nodes. The most common setup uses the Modular Layer 2 (ML2) plugin, which supports multiple type drivers (flat, VLAN, VXLAN, GRE) and mechanism drivers (Linux bridge, Open vSwitch, SR-IOV).

Key agents include:

• L2 agent (linuxbridge or openvswitch) – manages the virtual switches on each compute node. It creates the bridges, applies VLAN/VXLAN tags, and enforces security group rules via iptables or OpenFlow.
• DHCP agent – runs a dnsmasq process per network to provide IP addresses and DNS to instances. It listens on the network’s DHCP port.
• L3 agent – provides routing between networks and floating IPs (NAT). It runs on network nodes (or on compute nodes with DVR) and manages namespaces, iptables, and routing tables.
• Metadata agent – supplies instance metadata (like SSH keys) via a proxy to the Nova metadata service.

When you create a network, the ML2 plugin validates it and stores it. The L2 agent on each compute node then creates the corresponding local network (e.g., a Linux bridge or OVS bridge) and connects it to the physical NIC or a VXLAN tunnel. The DHCP agent starts a dnsmasq process for that network. The L3 agent creates a router namespace if you attach a router.

Setting Up a Basic Tenant Network

For a simple project network (e.g., a private VXLAN network with a router to the external network), the typical steps are:

1. Create a network: openstack network create private-net
2. Create a subnet: openstack subnet create --network private-net --subnet-range 192.168.100.0/24 --gateway 192.168.100.1 private-subnet
3. Create a router: openstack router create router1
4. Attach the subnet to the router: openstack router add subnet router1 private-subnet
5. Set the router’s external gateway: openstack router set --external-gateway public-net router1
6. Boot an instance on the private network: openstack server create --flavor m1.small --image cirros --network private-net instance1

After these steps, the instance gets an IP from the subnet’s pool, and the router provides SNAT for outbound traffic. For inbound access, you create a floating IP and associate it with the instance’s port.

Floating IPs and Security Groups

A floating IP is a public IP that maps to a private IP via 1:1 NAT in the L3 agent. You allocate it from an external network’s pool and associate it to a port:

openstack floating ip create public-net then openstack server add floating ip instance1 <floating-ip>. The L3 agent creates a DNAT rule in the router’s namespace so traffic to the floating IP is forwarded to the instance’s private IP.

Security groups are stateful firewalls applied at the port level. The default security group allows all outbound and only inbound traffic that matches established connections. To allow SSH, you add a rule:

openstack security group rule create --proto tcp --dst-port 22 default. Rules are implemented by the L2 agent using iptables or OpenFlow, and they are evaluated before the instance sees the traffic.

Common Problems and Troubleshooting

Neutron issues often manifest as instances with no network, unreachable IPs, or slow DHCP. Here are the most frequent problems and how to address them:

• Instance gets no IP – Check that the DHCP agent is running (openstack network agent list), that the subnet has an allocation pool, and that the network’s DHCP port is in the ACTIVE state. On the compute node, check ip netns to see if the DHCP namespace exists.
• No external connectivity – Verify the router has an external gateway and that the external network is shared (or you own it). Test from the network node: ip netns exec qrouter-<id> ping 8.8.8.8. Also check that the provider network’s physical interface is up and has the correct VLAN/tunnel configuration.
• Floating IP not working – Ensure the floating IP is associated with the correct port, and that the security group allows inbound traffic on the needed ports. Check the L3 agent’s iptables rules: ip netns exec qrouter-<id> iptables -t nat -L.
• Slow DHCP – The DHCP agent uses dnsmasq; if the network has many subnets, it may be slow. Restart the agent, or increase the dnsmasq lease time. Also check for IP conflicts in the allocation pool.
• VXLAN traffic not working between compute nodes – Verify that the multicast group (or unicast with BGP EVPN) is reachable, and that the vxlan kernel module is loaded. On each node, check bridge fdb show | grep vxlan to see if the tunnel is up.

Always start with openstack network agent list to see if all agents are reported alive. If an agent is down, instances on that node may lose connectivity.

Provider Networks vs. Self-Service Networks

OpenStack distinguishes between two main network types:

• Provider networks – created by an admin, mapped directly to an existing physical network (e.g., a VLAN or flat network). Instances get IPs from the same subnet as the physical network, and there is no routing or NAT involved. This is simple and offers high performance, but it consumes public IPs and is not isolated per tenant.
• Self-service (tenant) networks – created by regular users, usually isolated via VXLAN or GRE tunnels. They give tenants full control over their IP space and topology, but require a router (often with SNAT/DNAT) to reach the outside world. This is the default for most public and private clouds.

For production, you often use a mix: provider networks for external-facing services (e.g., a public subnet) and self-service networks for internal traffic. The choice affects performance (VXLAN encapsulation adds overhead) and complexity.

Frequently Asked Questions

What is the difference between Neutron and Nova networking?

Nova networking (legacy) was a simple flat or VLAN setup managed by Nova’s compute service. Neutron is a separate, pluggable service that provides a full API for networks, subnets, routers, and firewalls. Neutron is the current standard and supports advanced features like VXLAN, distributed routing, and network functions virtualization (NFV).

How do I allow traffic between two instances on different tenant networks?

You need a router (or a shared network) that connects both networks. Create a router, attach both subnets to it, and ensure the security groups on both instances allow the desired traffic. If the networks are in different projects, you may need to share the router or use a shared network.

Why is my instance’s floating IP not reachable from outside?

Check the router’s external gateway, the floating IP association, and the security group rules. Also verify that the L3 agent is running on the node hosting the router. A common mistake is forgetting to allow inbound SSH in the security group.

Can I use IPv6 with Neutron?

Yes. Neutron supports IPv6 subnets with various address modes (SLAAC, DHCPv6, stateful). You can create an IPv6 subnet alongside an IPv4 one on the same network. The router can provide IPv6 routing if the external network has IPv6 connectivity.

What is DVR in OpenStack networking?

Distributed Virtual Routing (DVR) moves L3 routing from centralized network nodes to compute nodes, so east-west traffic (between instances on different nodes) does not need to hop through a central router. It improves performance and scalability, but requires careful configuration and is not supported with all plugins.

How do I reset a broken Neutron agent?

First, identify the agent with openstack network agent list. Then restart the corresponding service on the node, e.g., sudo systemctl restart neutron-linuxbridge-agent. If the agent does not come back, check its logs (/var/log/neutron/linuxbridge-agent.log) for configuration errors or database connectivity issues.

Related

• Nothing Phones & Earbuds: Best Buy Store Guide
• Plex vs Jellyfin vs Emby: Why Choose Plex?
• Fire TV Remote Shortcuts: Hidden Buttons & Tips