Connect to Internal Platform Services

Some platform services — like the Shared File Storage backend and the internal DNS resolver — live on a private services network, not the public internet. Your instances already have a default route through your primary router, but reaching these services needs one extra, internal-only router.

Unlike the rest of this section, there's no Horizon click-through for this yet — it's set up entirely with the openstack CLI.

Prerequisites

• The OpenStack CLI installed and configured.
• An existing VPC network and subnet (see Create and Attach a VPC).

Steps

Track your progress. Data is saved locally in your browser.

Checklist: None

Create your services router

This router's gateway sits on the internal services-access network instead of the public one — your instances' default route through your primary router is untouched.

openstack router create svc-router
openstack router set --external-gateway services-access svc-router

Attach it to your network

Attach by port, not by subnet, so this router never claims your subnet's gateway address. Any free address in your subnet works — .254 is just a convention.

openstack port create --network <your-net> \
  --fixed-ip subnet=<your-subnet>,ip-address=192.168.x.254 svc-port
openstack router add port svc-router svc-port

Point traffic at the services you need

Nothing routes through svc-router until you tell your subnet to send specific destinations there. Add one host route per service:

Service	Destination
Shared File Storage (Manila/NFS)	see the share creation guide for the current prefix
Internal DNS resolver	10.0.245.0/24

openstack subnet set \
  --host-route destination=<service-prefix>,gateway=192.168.x.254 \
  <your-subnet>

On an already-running instance, renew its DHCP lease to pick up the new route: dhclient -r && dhclient <iface> (or reboot).

Find your outbound address

Some services (like Manila's access rules) authenticate by source IP — this is the address your traffic to internal services appears from, not your instance's private IP.

openstack router show svc-router -c external_gateway_info

TIP

This is a small, working, self-service path today. The exact addresses and mechanism may evolve as the platform grows past a handful of tenants — nothing about your instance's own configuration will need to change if it does.

Troubleshooting

• Nothing on the destination is reachable at all: this is expected until the host route from step 3 is set — by design, nothing routes through svc-router without one.
• Was reachable, now isn't, after adding a host route: an already-running instance needs its DHCP lease renewed (see the note under step 3) before it picks up the new route.