# OVN network
is a software-defined networking system that supports virtual network abstraction.
You can use it to build your own private cloud.
See [`www.ovn.org`](https://www.ovn.org/) for more information.
The `ovn` network type allows to create logical networks using the OVN .
This kind of network can be useful for labs and multi-tenant environments where the same logical subnets are used in multiple discrete networks.
A LXD OVN network can be connected to an existing managed [Bridge network](https://canonical.com/lxd/docs/default/reference/network_bridge/index.html.md#network-bridge) or [Physical network](https://canonical.com/lxd/docs/default/reference/network_physical/index.html.md#network-physical) to gain access to the wider network.
By default, all connections from the OVN logical networks are NATed to an IP allocated from the uplink network.
See [How to set up OVN with LXD](https://canonical.com/lxd/docs/default/howto/network_ovn_setup/index.html.md#network-ovn-setup) for basic instructions for setting up an OVN network.
#### NOTE
Static DHCP assignments depend on the client using its MAC address as the DHCP identifier.
This method prevents conflicting leases when copying an instance, and thus makes statically assigned leases work properly.
## OVN networking architecture
The following figure shows the OVN network traffic flow in a LXD cluster:
The OVN network connects the different cluster members.
Network traffic between the cluster members passes through the NIC for inter-cluster traffic (`eth1` in the figure) and is transmitted through an OVN tunnel.
This traffic between cluster members is referred to as *OVN east/west traffic*.
For outside connectivity, the OVN network requires an uplink network (a [Bridge network](https://canonical.com/lxd/docs/default/reference/network_bridge/index.html.md#network-bridge) or a [Physical network](https://canonical.com/lxd/docs/default/reference/network_physical/index.html.md#network-physical)).
The OVN network uses a virtual router to connect to the uplink network through the NIC for uplink traffic (`eth0` in the figure).
The virtual router is active on only one of the cluster members, and can move to a different member at any time.
Independent of where the router resides, the OVN network is available on all cluster members.
Every instance on any cluster member can connect to the OVN network through its virtual NIC (usually `eth0` for containers and `enp5s0` for virtual machines).
The traffic between the instances and the uplink network is referred to as *OVN north/south traffic*.
The strengths of using OVN become apparent when looking at a networking architecture with more than one OVN network:
In this case, both depicted OVN networks are completely independent.
Both networks are available on all cluster members (with each virtual router being active on one random cluster member).
Each instance can use either of the networks, and the traffic on either network is completely isolated from the other network.
## Configuration options
The following configuration key namespaces are currently supported for the `ovn` network type:
- `bridge` (L2 interface configuration)
- `dns` (DNS server and resolution configuration)
- `ipv4` (L3 IPv4 configuration)
- `ipv6` (L3 IPv6 configuration)
- `security` (network ACL configuration)
- `user` (free-form key/value for user metadata)
#### NOTE
LXD uses the [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) where network subnet information is required, for example, `192.0.2.0/24` or `2001:db8::/32`. This does not apply to cases where a single address is required, for example, local/remote addresses of tunnels, NAT addresses or specific addresses to apply to an instance.
The following configuration options are available for the `ovn` network type:
`acceleration.parent`
Physical function interfaces to allocate virtual functions from for hardware acceleration
[](#network-ovn-network-conf:acceleration.parent)
| **Key:** | `acceleration.parent` |
|-------------|-------------------------|
| **Type:** | string |
Comma separated list of physical function (PF) interfaces to allocate virtual functions (VFs) from for hardware acceleration when [`acceleration`](https://canonical.com/lxd/docs/default/reference/devices_nic/index.html.md#device-nic-ovn-device-conf:acceleration) is enabled.
See [SR-IOV hardware acceleration](https://canonical.com/lxd/docs/default/reference/devices_nic/index.html.md#devices-nic-hw-acceleration) for more information.
`bridge.hwaddr`
MAC address for the bridge
[](#network-ovn-network-conf:bridge.hwaddr)
| **Key:** | `bridge.hwaddr` |
|-------------|-------------------|
| **Type:** | string |
`bridge.mtu`
Bridge MTU
[](#network-ovn-network-conf:bridge.mtu)
| **Key:** | `bridge.mtu` |
|--------------|----------------|
| **Type:** | integer |
| **Default:** | `1442` |
The default value allows the host to host Geneve tunnels.
`dns.domain`
Domain to advertise to DHCP clients and use for DNS resolution
[](#network-ovn-network-conf:dns.domain)
| **Key:** | `dns.domain` |
|--------------|----------------|
| **Type:** | string |
| **Default:** | `lxd` |
`dns.search`
Full domain search list
[](#network-ovn-network-conf:dns.search)
| **Key:** | `dns.search` |
|--------------|--------------------|
| **Type:** | string |
| **Default:** | `dns.domain` value |
Specify a comma-separated list of domains.
`dns.zone.forward`
DNS zone names for forward DNS records
[](#network-ovn-network-conf:dns.zone.forward)
| **Key:** | `dns.zone.forward` |
|-------------|----------------------|
| **Type:** | string |
Specify a comma-separated list of DNS zone names.
`dns.zone.reverse.ipv4`
DNS zone name for IPv4 reverse DNS records
[](#network-ovn-network-conf:dns.zone.reverse.ipv4)
| **Key:** | `dns.zone.reverse.ipv4` |
|-------------|---------------------------|
| **Type:** | string |
`dns.zone.reverse.ipv6`
DNS zone name for IPv6 reverse DNS records
[](#network-ovn-network-conf:dns.zone.reverse.ipv6)
| **Key:** | `dns.zone.reverse.ipv6` |
|-------------|---------------------------|
| **Type:** | string |
`ipv4.address`
IPv4 address for the OVN network
[](#network-ovn-network-conf:ipv4.address)
| **Key:** | `ipv4.address` |
|----------------|-----------------------------------|
| **Type:** | string |
| **Default:** | initial value on creation: `auto` |
| **Condition:** | standard mode |
Use CIDR notation.
You can set the option to `none` to turn off IPv4, or to `auto` to generate a new random unused subnet.
`ipv4.dhcp`
Whether to allocate IPv4 addresses using DHCP
[](#network-ovn-network-conf:ipv4.dhcp)
| **Key:** | `ipv4.dhcp` |
|----------------|---------------|
| **Type:** | bool |
| **Default:** | `true` |
| **Condition:** | IPv4 address |
`ipv4.dhcp.ranges`
IPv4 ranges to use for DHCP
[](#network-ovn-network-conf:ipv4.dhcp.ranges)
| **Key:** | `ipv4.dhcp.ranges` |
|----------------|----------------------|
| **Type:** | string |
| **Default:** | all addresses |
| **Condition:** | IPv4 DHCP |
| **Scope:** | global |
Specify a comma-separated list of IPv4 ranges in FIRST-LAST format.
`ipv4.l3only`
Whether to enable layer 3 only mode for IPv4
[](#network-ovn-network-conf:ipv4.l3only)
| **Key:** | `ipv4.l3only` |
|----------------|-----------------|
| **Type:** | bool |
| **Default:** | `false` |
| **Condition:** | IPv4 address |
`ipv4.nat`
Whether to use NAT for IPv4
[](#network-ovn-network-conf:ipv4.nat)
| **Key:** | `ipv4.nat` |
|----------------|--------------------------------------------------------------------------------|
| **Type:** | bool |
| **Default:** | `false` (initial value on creation if `ipv4.address` is set to `auto`: `true`) |
| **Condition:** | IPv4 address |
`ipv4.nat.address`
Source address used for outbound traffic from the network
[](#network-ovn-network-conf:ipv4.nat.address)
| **Key:** | `ipv4.nat.address` |
|----------------|---------------------------------------------------------|
| **Type:** | string |
| **Condition:** | IPv4 address; requires uplink `ovn.ingress_mode=routed` |
`ipv6.address`
IPv6 address for the OVN network
[](#network-ovn-network-conf:ipv6.address)
| **Key:** | `ipv6.address` |
|----------------|-----------------------------------|
| **Type:** | string |
| **Default:** | initial value on creation: `auto` |
| **Condition:** | standard mode |
Use CIDR notation.
You can set the option to `none` to turn off IPv6, or to `auto` to generate a new random unused subnet.
`ipv6.dhcp`
Whether to provide additional network configuration over DHCP
[](#network-ovn-network-conf:ipv6.dhcp)
| **Key:** | `ipv6.dhcp` |
|----------------|---------------|
| **Type:** | bool |
| **Default:** | `true` |
| **Condition:** | IPv6 address |
`ipv6.dhcp.stateful`
Whether to allocate IPv6 addresses using DHCP
[](#network-ovn-network-conf:ipv6.dhcp.stateful)
| **Key:** | `ipv6.dhcp.stateful` |
|----------------|------------------------|
| **Type:** | bool |
| **Default:** | `false` |
| **Condition:** | IPv6 DHCP |
`ipv6.l3only`
Whether to enable layer 3 only mode for IPv6
[](#network-ovn-network-conf:ipv6.l3only)
| **Key:** | `ipv6.l3only` |
|----------------|--------------------|
| **Type:** | bool |
| **Default:** | `false` |
| **Condition:** | IPv6 DHCP stateful |
`ipv6.nat`
Whether to use NAT for IPv6
[](#network-ovn-network-conf:ipv6.nat)
| **Key:** | `ipv6.nat` |
|----------------|--------------------------------------------------------------------------------|
| **Type:** | bool |
| **Default:** | `false` (initial value on creation if `ipv6.address` is set to `auto`: `true`) |
| **Condition:** | IPv6 address |
`ipv6.nat.address`
Source address used for outbound traffic from the network
[](#network-ovn-network-conf:ipv6.nat.address)
| **Key:** | `ipv6.nat.address` |
|----------------|---------------------------------------------------------|
| **Type:** | string |
| **Condition:** | IPv6 address; requires uplink `ovn.ingress_mode=routed` |
`network`
Uplink network to use for external network access
[](#network-ovn-network-conf:network)
| **Key:** | `network` |
|-------------|-------------|
| **Type:** | string |
`security.acls`
Network ACLs to apply to NICs connected to this network
[](#network-ovn-network-conf:security.acls)
| **Key:** | `security.acls` |
|-------------|-------------------|
| **Type:** | string |
Specify a comma-separated list of network ACLs.
`security.acls.default.egress.action`
Default action to use for egress traffic
[](#network-ovn-network-conf:security.acls.default.egress.action)
| **Key:** | `security.acls.default.egress.action` |
|----------------|-----------------------------------------|
| **Type:** | string |
| **Default:** | `reject` |
| **Condition:** | `security.acls` |
The specified action is used for all egress traffic that doesn’t match any ACL rule.
`security.acls.default.egress.logged`
Whether to log egress traffic that doesn’t match any ACL rule
[](#network-ovn-network-conf:security.acls.default.egress.logged)
| **Key:** | `security.acls.default.egress.logged` |
|----------------|-----------------------------------------|
| **Type:** | bool |
| **Default:** | `false` |
| **Condition:** | `security.acls` |
`security.acls.default.ingress.action`
Default action to use for ingress traffic
[](#network-ovn-network-conf:security.acls.default.ingress.action)
| **Key:** | `security.acls.default.ingress.action` |
|----------------|------------------------------------------|
| **Type:** | string |
| **Default:** | `reject` |
| **Condition:** | `security.acls` |
The specified action is used for all ingress traffic that doesn’t match any ACL rule.
`security.acls.default.ingress.logged`
Whether to log ingress traffic that doesn’t match any ACL rule
[](#network-ovn-network-conf:security.acls.default.ingress.logged)
| **Key:** | `security.acls.default.ingress.logged` |
|----------------|------------------------------------------|
| **Type:** | bool |
| **Default:** | `false` |
| **Condition:** | `security.acls` |
`user.*`
User-provided free-form key/value pairs
[](#network-ovn-network-conf:user.*)
| **Key:** | `user.*` |
|-------------|------------|
| **Type:** | string |
## Supported features
The following features are supported for the `ovn` network type:
- [How to configure network ACLs](https://canonical.com/lxd/docs/default/howto/network_acls/index.html.md#network-acls)
- [How to configure network forwards](https://canonical.com/lxd/docs/default/howto/network_forwards/index.html.md#network-forwards)
- [How to configure network zones](https://canonical.com/lxd/docs/default/howto/network_zones/index.html.md#network-zones)
- [How to create OVN peer routing relationships](https://canonical.com/lxd/docs/default/howto/network_ovn_peers/index.html.md#network-ovn-peers)
- [How to configure network load balancers](https://canonical.com/lxd/docs/default/howto/network_load_balancers/index.html.md#network-load-balancers)