In a reference implementation, virtual routers created in Neutron exist as network namespaces that reside on nodes running the neutron-l3-agent service. A virtual router is often connected to a single external provider network and one or more tenant networks. Router interfaces connected to these networks can be identified as:
qg—gateway interfaceqr—router interface
Neutron routers are responsible for providing inbound and outbound connectivity to and from tenant networks through the use of network address translation or NAT. The following diagram shows how a router namespace may be connected to multiple bridges in a LinuxBridge implementation:
Figure 7.1
The preceding diagram demonstrates a Neutron router connected to multiple bridges in a LinuxBridge-based implementation. Traffic from tenant networks is routed in from qr interfaces and out the qg interface onto the external network. Routing tables within the namespace dictate how traffic is routed, and iptables rules...