---
title: "Cloud routers"
sidebar_label: "Cloud routers"
sidebar_position: 7
description: "How to create a cloud router, connect a subnet to a cloud router, connect a router to the internet, and other instructions"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical'
import TrashIcon from '@selectel/docux/icons/trash'
import CheckIcon from '@selectel/docux/icons/check'
import EditIcon from '@selectel/docux/icons/edit'
import ConnectPrivateSubnetToCloudRouter from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/cloud-networks/connect-private-subnet-to-cloud-router.mdx'
import DisconnectPrivateSubnetFromCloudRouter from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/cloud-networks/disconnect-private-subnet-from-cloud-router.mdx'

# Cloud routers

With a cloud router, you can:

* route traffic between [private subnets](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx). All private subnets connected to the same router can exchange traffic and use the router's IP address as the default route;
* configure internet access for devices in a private subnet (outbound traffic) and from the internet (inbound traffic); for more information, see the [Configure internet access and access from the internet](/cloud-servers/cloud-networks/configure-access-to-internet.mdx) instructions. The cloud router performs 1:1 NAT via an external IP address allocated when connecting the router to the internet: it organizes internet access from the private subnet and processes inbound traffic packets for [public IP addresses](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx).

You can [configure static routes](/cloud-servers/cloud-networks/static-routes.mdx#configure-static-routing-on-cloud-router) on a cloud router.

A cloud router can only be used within a single [project](/access-control/projects/about-projects.mdx) and a single [pool](/infrastructure/locations.mdx#pool).

For cloud routers, there are traffic volume limitations: bandwidth. You can check it in the [Bandwidth](/cloud-servers/cloud-networks/about-networks.mdx#bandwidth) table.

You can work with cloud routers in the [Control panel](https://my.selectel.ru/vpc/default/networks/), using the [OpenStack CLI](/cloud-servers/tools/openstack-cli/), or with [Terraform](/terraform/providers/).

## Cloud router types \{#cloud-router-types}

Two router types are available:

* Basic — consists of one instance. In case of failure, connectivity through the router will be disrupted;

* High availability — consists of primary and backup instances located in different [pool](/infrastructure/locations.mdx#pool) segments and joined via VRRP.

  Redundancy works in Active-Passive mode: only one instance (primary) is active at a time, and traffic switches to the backup instance upon failure. The switchover takes up to 10 seconds; connections are interrupted and re-established on the backup instance. The instances swap roles — the backup becomes the primary. If the router has a [firewall](/cloud-servers/firewalls/about-firewalls.mdx), its settings are preserved.

You can select the router type when [creating a router](#create-cloud-router). After creation, you can change its type only via the OpenStack CLI: [enable redundancy](#enable-cloud-router-ha) or [disable redundancy](#disable-cloud-router-ha).

## Create a cloud router \{#create-cloud-router}

<Tabs queryString="create-cloud-router">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), in the top menu, click **Products** and select **Cloud Servers**.
    2. Go to **Network** → **Cloud Routers tab**.
    3. Click **Create router**.
    4. Select the [location](/infrastructure/locations.mdx) in which the cloud router will be created.
    5. Select the [router type](#cloud-router-types). You can change the router type after creation: [enable redundancy](#enable-cloud-router-ha) or [disable redundancy](#disable-cloud-router-ha).
    6. Enter a router name.
    7. Optional: select the **Connect router to the Internet** checkbox — an external IP address will be allocated for the router.
    8. Click **Create**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Create a cloud router:

       ```bash
       openstack router create <router_name> --ha --availability-zone-hint <availability_zone>
       ```

       Specify:

       * `<router_name>` — cloud router name;

       * `--ha` — specify to create a router with the With redundancy [type](#cloud-router-types). If you do not specify the parameter, a router with the Basic type will be created. You can change the router type after creation: [enable redundancy](#enable-cloud-router-ha) or [disable redundancy](#disable-cloud-router-ha);

       * optional: `--availability-zone-hint <availability_zone>` — pool segments where router instances will be located. The `<availability_zone>` parameter is a pool segment, for example, `ru-6a`. Specify at least two segments, each in a separate parameter, for example, `--availability-zone-hint ru-6a --availability-zone-hint ru-6b`.

    3. Optional: connect the cloud router to the internet — an external IP address will be allocated for the router:

       ```bash
       openstack router set --external-gateway external-network <router>
       ```

       Specify `<router>` — the ID or name of the cloud router; you can view it using the `openstack router list` command.
  </TabItem>
</Tabs>

## Connect a subnet to a cloud router \{#connect-private-subnet-to-cloud-router}

For devices in private subnets of the same pool to exchange traffic, the subnets must be connected to the same cloud router. The subnets must not overlap — they must not contain identical IP addresses.

To configure internet access and access from the internet for devices in private subnets, use the [Configure internet access and access from the internet](/cloud-servers/cloud-networks/configure-access-to-internet.mdx) instructions.

<ConnectPrivateSubnetToCloudRouter />

## Disconnect a subnet from a cloud router \{#disconnect-private-subnet-from-cloud-router}

<DisconnectPrivateSubnetFromCloudRouter />

## Connect a cloud router to the internet \{#connect-cloud-router-to-internet}

To configure internet access for devices in a private subnet, the subnet must be connected to a cloud router with internet access. For internet access, the router connects to an external network (`external-network`), and an external IP address is allocated to it, through which the router will perform 1:1 NAT. The router's external IP address does not change while the router is connected to the internet.

You cannot access devices behind the router from the internet using the router's external IP address. It is only used for devices to access the internet through the router.

To configure access from the internet to devices, use a public IP address or a public subnet; for more information, see the [Configure internet access and access from the internet⁠](/cloud-servers/cloud-networks/configure-access-to-internet.mdx) instructions.

<Tabs queryString="connect-cloud-router-to-internet">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), in the top menu, click **Products** and select **Cloud Servers**.
    2. Go to **Network** → **Cloud Routers tab**.
    3. In the cloud router's <MoreVerticalIcon /> menu, select **Connect to internet**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Connect the cloud router to the internet:

       ```bash
       openstack router set --external-gateway external-network <router>
       ```

       Specify `<router>` — the ID or name of the cloud router; you can view it using the `openstack router list` command.
  </TabItem>
</Tabs>

## Disconnect a cloud router from the internet \{#disconnect-cloud-router-from-internet}

If you disconnect the cloud router from the internet, its external IP address will return to the address pool. After reconnecting, the IP address will change.

A cloud router cannot be disconnected from the internet if it processes traffic for public IP addresses.

<Tabs queryString="disconnect-cloud-router-from-internet">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), in the top menu, click **Products** and select **Cloud Servers**.
    2. Go to **Network** → **Cloud Routers tab**.
    3. In the cloud router's <MoreVerticalIcon /> menu, select **Disconnect from internet**.
    4. Click **Disconnect**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Disconnect the cloud router from the internet:

       ```bash
       openstack router unset --external-gateway <router>
       ```

       Specify `<router>` — the ID or name of the cloud router; you can view it using the `openstack router list` command.
  </TabItem>
</Tabs>

## Assign a firewall to a cloud router port \{#assign-firewall-to-cloud-router-port}

:::warning

Inbound and outbound traffic that is not allowed by the cloud firewall rules will be blocked on the cloud router port. Active sessions on the router that are not allowed by the new rules will be terminated.

:::

You cannot assign more than one firewall to a single router port.

<Tabs queryString="assign-firewall-to-cloud-router-port">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), in the top menu, click **Products** and select **Cloud Servers**.
    2. Go to **Network** → **Cloud Routers tab**.
    3. Open the cloud router page.
    4. In the line of the private subnet port for which you need to configure traffic filtering, in the **Firewall** field, click <EditIcon />.
    5. Select a firewall.
    6. Click **Save**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Assign a firewall to the cloud router port:

       ```bash
       openstack firewall group set --port <router_port> <firewall>
       ```

       Specify:

       * `<router_port>` — ID or name of the router port to which the firewall will be assigned; you can view it using the `openstack port list` command. To assign the firewall to multiple router ports, list their IDs or names separated by a space;
       * `<firewall>` — the ID or name of the firewall; you can view it using the `openstack firewall group list` command.
  </TabItem>
</Tabs>

## Detach a firewall from a cloud router port \{#disconnect-firewall-from-cloud-router-port}

:::warning

The cloud firewall rules will no longer apply — all inbound and outbound traffic passing through the cloud router port will be allowed.

:::

<Tabs queryString="disconnect-firewall-from-cloud-router-port">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), in the top menu, click **Products** and select **Cloud Servers**.
    2. Go to **Network** → **Cloud Routers tab**.
    3. Open the router page.
    4. In the line of the private subnet port for which traffic filtering was configured, in the **Firewall** field, click <EditIcon />.
    5. Select **No firewall**.
    6. Click **Save**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Detach the firewall from the router port:

       ```bash
       openstack firewall group unset --port <router_port> <firewall>
       ```

       Specify:

       * `<router_port>` — the ID or name of the router port from which the firewall will be disconnected; you can view it using the `openstack port list` command;
       * `<firewall>` — the ID or name of the firewall; you can view it using the `openstack firewall group list` command.
  </TabItem>
</Tabs>

## Enable cloud router redundancy \{#enable-cloud-router-ha}

:::warning

Active sessions on the router will be interrupted for the duration of the operation.

:::

You can enable redundancy. The [router type](#cloud-router-types) will change to High availability, and an additional instance will be added to the router.

<Tabs queryString="enable-cloud-router-ha">
  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Shut down the cloud router:

       ```bash
       openstack router set <router> --disable
       ```

       Specify `<router>` — the name of the cloud router; you can view it using the `openstack router list` command.

    3. Enable redundancy. An additional instance will be added to the router:

       ```bash
       openstack router set <router> --ha
       ```

       Specify:

       * `<router>` — the ID or name of the cloud router; you can view it using the `openstack router list` command;
       * optional: `--availability-zone-hint <availability_zone>` — pool segments where router instances will be located. The `<availability_zone>` parameter is a pool segment, for example, `ru-6a`. Specify at least two segments, each in a separate parameter, for example, `--availability-zone-hint ru-6a --availability-zone-hint ru-6b`.

    4. Turn on the cloud router:

       ```bash
       openstack router set --enable <router>
       ```

       Specify `<router>` — the ID or name of the router; you can view it using the `openstack router list` command.

       Connections that were interrupted when the router was shut down will be restored automatically on its original instance.
  </TabItem>
</Tabs>

## Disable cloud router redundancy \{#disable-cloud-router-ha}

:::warning

Active sessions on the router will be interrupted for the duration of the operation.

:::

You can disable redundancy. The [router type](#cloud-router-types) will change to Basic, and the backup router instance will be deleted.

<Tabs queryString="disable-cloud-router-ha">
  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Shut down the cloud router:

       ```bash
       openstack router set <router> --disable
       ```

       Specify `<router>` — the name of the cloud router; you can view it using the `openstack router list` command.

    3. Disable redundancy. The backup router instance that was inactive before shutdown will be deleted:

       ```bash
       openstack router set <router> --no-ha
       ```

       Specify:

       * `<router>` — the ID or name of the cloud router; you can view it using the `openstack router list` command.

    4. Turn on the cloud router:

       ```bash
       openstack router set --enable <router>
       ```

       Specify `<router>` — the ID or name of the router; you can view it using the `openstack router list` command.

       Connections that were interrupted when the router was shut down will be restored automatically.
  </TabItem>
</Tabs>

## Turn on a cloud router \{#enable-cloud-router}

<Tabs queryString="enable-cloud-router">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), in the top menu, click **Products** and select **Cloud Servers**.
    2. Go to **Network** → **Cloud Routers tab**.
    3. In the cloud router card, turn on the router.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Turn on the cloud router:

       ```bash
       openstack router set --enable <router>
       ```

       Specify `<router>` — the ID or name of the router; you can view it using the `openstack router list` command.
  </TabItem>
</Tabs>

## Turn off a cloud router \{#disable-cloud-router}

A router cannot be disabled if it processes traffic for a [public IP address](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx).

<Tabs queryString="disable-cloud-router">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), in the top menu, click **Products** and select **Cloud Servers**.
    2. Go to **Network** → **Cloud Routers tab**.
    3. In the cloud router card, turn off the router.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Shut down the cloud router:

       ```bash
       openstack router set --disable <router>
       ```

       Specify `<router>` — the ID or name of the cloud router; you can view it using the `openstack router list` command.
  </TabItem>
</Tabs>

## Delete a cloud router \{#delete-cloud-router}

<Tabs queryString="delete-cloud-router">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), in the top menu, click **Products** and select **Cloud Servers**.

    2. Go to **Network** → **Cloud Routers tab**.

    3. Disconnect all connected subnets from the router by removing all subnet ports from the router:

       3.1. Open the router page → **Ports tab**.

       3.2. In the line of any port, click <TrashIcon />.

       3.3. Click **Delete**.

       3.4. Repeat steps 3.2–3.3 for all remaining ports.

    4. In the router's <MoreVerticalIcon /> menu, select **Delete router**.

    5. Click **Delete**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. If subnets are connected to the router, delete the router ports:

       ```bash
       openstack router remove port <router> <port_id>
       ```

       Specify:

       * `<router>` — the ID or name of the cloud router; you can view it using the `openstack router list` command;
       * `<port_id>` — the ID of the port connected to the router; you can view it using the `openstack port list --router <router>` command.

    3. Delete the router:

       ```bash
       openstack router delete <router>
       ```
  </TabItem>
</Tabs>

<Formbricks />