Attaching a Floating IP to an OpenStack Instance via Neutron L3 Router

Attaching a floating IP for external reachability

The quickest way to make an instance reachable from outside an OpenStack cloud is to allocate a floating IP from an external (provider) network and associate it with the instance’s fixed port. Neutron’s L3 router performs the NAT translation that maps the floating IP to the instance’s private address.

How the Neutron L3 router handles floating IPs

A Neutron L3 router acts as a virtual NAT device. When you set an external gateway on the router, traffic arriving at the router’s external interface is examined: if the destination matches a floating IP, the router performs DNAT to rewrite the destination to the instance’s private IP and forwards the packet to the appropriate internal interface. Return traffic from the instance is SNATed so the source appears as the floating IP. This keeps the internal network isolated while providing inbound and outbound connectivity.

Key terms:

• Floating IP – a publicly routable address taken from an external network.
• External network – a Neutron network marked external:true that has a gateway and is usually a provider network.
• SNAT/DNAT – source and destination network address translation performed by the router.

Worked example configuration

The following CLI snippet shows the minimal steps. Run each command as a user with sufficient rights (typically admin or a project member with the network role). Replace placeholders surrounded by angle brackets with values from your environment.

# 1. Create an external network (flat provider network example)
openstack network create ext-net \
  --external \
  --provider-network-type flat \
  --provider-physical-network physnet1

# 2. Create a subnet on the external network
openstack subnet create ext-subnet \
  --network ext-net \
  --subnet-range 203.0.113.0/24 \
  --gateway 203.0.113.1 \
  --no-dhcp

# 3. Create the L3 router and attach the external gateway
openstack router create my-router
openstack router set my-router --external-gateway ext-net

# 4. Create an internal network and subnet for instances
openstack network create internal-net
openstack subnet create internal-subnet \
  --network internal-net \
  --subnet-range 192.168.10.0/24 \
  --gateway 192.168.10.1

# 5. Attach the internal subnet to the router
openstack router add subnet my-router internal-subnet

# 6. Launch an instance in the internal subnet (example using an existing image and flavor)
openstack server create my-instance \
  --image  \
  --flavor  \
  --network internal-net \
  --wait

# 7. Identify the port ID of the instance
openstack port list --device-id $(openstack server show my-instance -f value -id) -f value -c ID
# Assume the output is 

# 8. Allocate a floating IP from the external network
openstack floating ip create ext-net -f value -c floating_ip_address
# Assume the output is 

# 9. Associate the floating IP with the instance port
openstack floating ip set --port  

To verify the setup:

1. From a machine outside the cloud (able to reach the external network), ping .
2. On the router’s network namespace (e.g., ip netns exec qrouter-), run tcpdump -i any -n icmp while the ping is active. You should see the external ICMP request DNAT’d to the instance’s private IP and the reply SNAT’d back to the floating IP.

Limits and common mistakes

• NAT table size – each active floating IP consumes a NAT entry. Very high numbers of concurrent connections can increase CPU usage on the router node; consider a load‑balancer or L7 proxy for massive scale.
• Single external gateway – a router can have only one external gateway. If you need multiple uplinks, create additional routers or use distributed virtual routing.
• Overlapping CIDRs – ensure the external subnet does not overlap any internal subnet or the router’s gateway IP; otherwise traffic will be misrouted.
• Missing enable-snat – by default the external gateway has SNAT enabled, but if you explicitly disabled it (e.g., via openstack router set --no-external-gateway or older versions), return traffic will not be translated and the instance will appear to have no outbound connectivity.
• Floating IP allocation failures – if the external network is not marked external:true or lacks a gateway, the openstack floating ip create command will succeed but the IP cannot be associated; check with openstack network show ext-net -c external -c gateway_ip.