Subnets, routers, and routes
Learn how networks, subnets, routers, static routes, and the route table work together, with an example of each part.
A network holds one or more subnets. A subnet is a block of private IPv4 addresses that instances and other resources get their addresses from. A router connects subnets with each other and, through its external gateway, with an external network. Static routes on a router send an address range to a next hop that you choose. This article explains each part. To create and change them, see Manage networks and subnets and Manage routers and static routes.
Networks
A network is the container for subnets. An instance's port is on the network and takes its fixed IP address from one of the network's subnets. A network that you create in the console has no address block of its own: its subnets carry the addresses, so the network's Address space shows a dash. The platform sets the network's MTU, which the network's page shows under MTU.
For example, a network app-net can hold the subnet 10.0.4.0/24 for web servers and the subnet 10.0.5.0/24 for databases.
DNS servers that you set when you create a network go to every subnet that you add to it, unless you give the subnet its own.
A new network is Building until the platform finishes it, and then Active. If something fails, the network shows Error, and its page shows the reason under What the provider reported.
Subnets
A subnet gives a network an address range. Instances on the subnet get their addresses from it through DHCP, and send traffic for other networks to the subnet's gateway address. For example, a subnet 10.0.4.0/24 with the gateway 10.0.4.1 hands out addresses such as 10.0.4.10 to its instances.
| Part | What it does |
|---|---|
| CIDR | The subnet's address block. In the console and the REST API, it must be a private IPv4 block inside 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. You can't change it in the console after the subnet is created. |
| Gateway | The address that instances send traffic for other networks to. By default, the first usable address of the block. A subnet can also have no gateway, and then traffic can't leave the subnet. |
| DHCP | Hands out addresses from the allocation pool, the DNS servers, and the host routes to the instances. It's on for every new subnet. |
| DNS servers | The resolvers that the instances get. Without any, the subnet uses the cloud's own resolvers, and its DNS servers column shows a dash. When the network itself has no DNS servers, its Overview tab shows Provider default. |
| Host routes | Extra routes that the instances receive through DHCP. |
| Allocation pool | The ranges that DHCP assigns addresses from. Without your own ranges, the pool is derived from the block. |
Subnets of different networks can have overlapping blocks, but subnets with overlapping blocks can't be routed together.
Routers
A router connects the subnets that are attached to it. Each attached subnet is an interface of the router. A router with an external gateway also connects these subnets to an external network, and through it to the internet.
| Part | What it is |
|---|---|
| Interface | The router's connection to one subnet. A subnet can be attached to a router once. |
| External gateway | The router's connection to an external network, with the router's public address under External IP. |
| SNAT | Address translation for outbound traffic: instances without a Floating IP reach the internet with the router's external address. |
| Static routes | Routes that you add for address ranges behind a next hop. See Static routes. |
| Admin state | Up or Down. You set it when you edit the router. |
The router's page also shows High availability and Distributed (DVR). You can't change them in the console.
An interface marked Service port was attached by another service in the cloud. Only that service can remove it.
External gateway and SNAT
When you create a router in the console, the platform picks one of the external networks that your project is allowed to use for Floating IPs and router gateways, and sets it as the router's external gateway. If your project can use none, the router has no gateway. In the console, you don't choose the external network: the router's page shows the one it got under External network.
The cloud turns on SNAT when it sets an external gateway, and you can't change it in the console. The router's page shows the state under SNAT. For how instances use SNAT and Floating IPs, see Internet access: SNAT and Floating IPs.
Without an external gateway, the router's subnets have no path to the internet. To set or clear the gateway, see Set or clear the external gateway.
Static routes
A static route sends traffic for a destination block to a next-hop address. For example, to reach an office network 10.20.0.0/16 through a VPN appliance at 10.0.1.254, add a route with the destination 10.20.0.0/16 and the next hop 10.0.1.254, where 10.0.1.0/24 is a subnet attached to the router.
The next hop must be reachable through a subnet that the router is connected to: an attached subnet or its external gateway's network. A router has one route per destination. To add routes, see Add a static route.
Host routes or static routes? A host route belongs to a subnet: DHCP hands it to the instances, and the instances send that traffic straight to the next hop. A static route belongs to a router and applies to the traffic that the router forwards.
Route table
The router's Route table tab lists the routes that its configuration gives it:
| Origin | Rows |
|---|---|
| Connected | One route for the address block of each attached subnet. |
| Static | Your static routes, with their next hops. |
| Default gateway | A route for 0.0.0.0/0 through the external gateway, when the router has one. |
The console builds the table from the router's interfaces, static routes, and external gateway.