All-in-One: How to set up a virtual external network completely inclosed within the host?

asked 2014-08-06 19:27:57 -0600

beni gravatar image

updated 2014-08-07 04:17:43 -0600

For a test setup of OpenStack, I followed (PackStack All-in-One DIY Configuration) on a virtual machine running Scientific Linux 6. The machine is located in a corporate OpenStack cloud. It is not (easily) possible to get an address range within this network that could be used for an external network for the instances. Thus, I will not be able to contact instances from outside the host. But I want to contact instances from the host and I want that instances can reach the host and the internet.


To be more precise: Might the host's IP be (that's just a random address and not my real one). For my test setup It is not possible to get IP addresses from for the instances. The host has just one NIC: eth0. I have set up a Neutron external network with the following properties

neutron subnet-create extnet --allocation-pool start=,end= --gateway --enable_dhcp=False

and an internal network with

neutron subnet-create rdonet

One of the instances has the _internal_ IP and _external_ IP


I want to achieve that

  • on the host I can run ping to reach the instance via its external IP address.
  • on the instance I want to be able to ping to reach the host and something like ping because I want to reach the internet.


As the configured external network is completely virtual, there is currently noone behind the gateway IP Thus a ping from an instance or the namespace of the router gets lost in the network. This can be seen when running tcpdump on qg-…, tap-… and br-ex as

ARP, Request who-has tell, length 28

without getting an answer where is the IP of the router.


What would be a good way to solve this? Create another router, interface or something else with OpenVSwitch and assign the gateway IP to it? And then add a route to the host's routing table to tell him to which interface packets to should go? Could I add a route that just says to route packets with target to br-ex?

Paste of some Configuration

Everything is in the same Gist (

  • # ifconfig : (
  • # ovs-vsctl show : ( . I think br-tun and patch-tun can be ignored for this question.
  • # route -n : https ...
edit retag flag offensive close merge delete

1 answer

Sort by » oldest newest most voted

answered 2014-08-11 08:50:59 -0600

beni gravatar image

updated 2014-08-11 09:20:58 -0600

I managed to achieve the second goal: on the instance I want to be able to ping to reach the host and something like ping because I want to reach the internet.

I started the tutorial from the beginning and before creating the OpenStack networks with neutron I did the following. I added the gateway IP address to br-ex:

  • ip link set down br-ex
  • ip addr add dev br-ex
  • ip link set up br-ex

Do not change /etc/sysconfig/network-scripts/ifcfg-br-ex to include the IP address because for me that interfered with OpenVSwitch and stopped it from creating the other interfaces.

Then I added iptables rules to create a NAT:

  • iptables -I FORWARD -i br-ex -j ACCEPT
  • iptables -I FORWARD -o br-ex -j ACCEPT
  • iptables -t nat -I POSTROUTING -s ! -d -j MASQUERADE

To add DNS support for external domains, I changed the private subnet to announce the same DNS servers my host is using:

neutron subnet-update $SUBNET_ID --dns-nameservers list=true $DNS1 $DNS2

After this change a reboot of the instances or a run of the DHCP client is necessary.

I don't know yet why I cannot reach the instances via their external addresses, but for now, this is enough for my test setup as I can reach the instances via

ip netns exec qdhcp-… ssh cirros@

The scripts I wrote for this setup are available under (

Actually, what I did looks a lot like what I now found here: ( which belongs to this screencast ( .

edit flag offensive delete link more

Get to know Ask OpenStack

Resources for moderators

Question Tools

1 follower


Asked: 2014-08-06 19:27:57 -0600

Seen: 9,025 times

Last updated: Aug 11 '14