---
title: "Cloud routers"
sidebar_label: "Cloud routers"
sidebar_position: 7
description: "How to create a cloud router, connect a subnet to a cloud router, connect a router to the internet, and other instructions"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical'
import TrashIcon from '@selectel/docux/icons/trash'
import CheckIcon from '@selectel/docux/icons/check'
import EditIcon from '@selectel/docux/icons/edit'
import ConnectPrivateSubnetToCloudRouter from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/cloud-networks/connect-private-subnet-to-cloud-router.mdx'
import DisconnectPrivateSubnetFromCloudRouter from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/cloud-networks/disconnect-private-subnet-from-cloud-router.mdx'

# Cloud routers

With a cloud router, you can:

* route traffic between [private subnets](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx). All private subnets connected to the same router can communicate with each other and use the router's IP address as the default route;
* configure internet access for devices in a private subnet (outgoing traffic) and from the internet (incoming traffic), learn more in the article [Configure internet access to and from the internet](/cloud-servers/cloud-networks/configure-access-to-internet.mdx). The cloud router performs 1:1 NAT via a public IP address allocated when the router is connected to the internet: it provides internet access from a private subnet and processes incoming traffic packets for [public IP addresses](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx).

On a cloud router, you can [configure static routes](/cloud-servers/cloud-networks/static-routes.mdx#configure-static-routing-on-cloud-router).

A cloud router can only be used within one [project](/access-control/projects/about-projects.mdx) and one [pool](/infrastructure/locations.mdx#pool).

Cloud routers have traffic volume limits, i.e., bandwidth. You can view it in the [Bandwidth](/cloud-servers/cloud-networks/about-networks.mdx#bandwidth) table.

You can work with cloud routers in the [Control panel](https://my.selectel.ru/vpc/default/networks/), using [OpenStack CLI](/cloud-servers/tools/openstack-cli/) or [Terraform](/terraform/providers/).

## Create a cloud router \{#create-cloud-router}

When creating a router in the [multi-availability zone pool](/infrastructure/locations.mdx#multi-az-pool) ru-6, you can select an [availability zone](/infrastructure/locations.mdx#availability-zone) where the router will be created. You can only select an availability zone when creating a router via OpenStack CLI.

<Tabs queryString="create-cloud-router">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Network** → **Cloud Routers** tab.
    3. Click **Create router**.
    4. Select a [location](/infrastructure/locations.mdx) where the cloud router will be created.
    5. Enter the router name.
    6. Optional: check the **Connect router to internet** box — an external IP address will be allocated for the router.
    7. Click **Create**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Create a cloud router:

       ```bash
       openstack router create <router_name>
       ```

       Specify:

       * `<router_name>` — name of the cloud router;
       * optional: `--availability-zone-hint <availability_zone>` — if the router is created in the [multi-availability zone pool](/infrastructure/locations.mdx#multi-az-pool) ru-6, this allows you to select an [availability zone](/infrastructure/locations.mdx#availability-zone) where the router will be created. The `<availability_zone>` parameter is a pool segment, for example `ru-6a`.

    3. Optional: connect the cloud router to the internet — an external IP address will be allocated for the router:

       ```bash
       openstack router set --external-gateway external-network <router>
       ```

       Specify `<router>` — the ID or name of the cloud router; you can view it using the `openstack router list` command.
  </TabItem>
</Tabs>

## Connect a subnet to a cloud router \{#connect-private-subnet-to-cloud-router}

To allow private subnets from different networks to communicate with each other, they must handle they be connected to the same cloud router. Subnets must not overlap — they must not contain identical IP addresses.

To configure internet access for devices in private subnets, see the [Configure access to the internet and from the internet](/cloud-servers/cloud-networks/configure-access-to-internet.mdx) guide.

<ConnectPrivateSubnetToCloudRouter />

## Disconnect a subnet from a cloud router \{#disconnect-private-subnet-from-cloud-router}

<DisconnectPrivateSubnetFromCloudRouter />

## Connect a cloud router to the internet \{#connect-cloud-router-to-internet}

To configure internet access for devices in a private subnet, the subnet must be connected to a cloud router with internet access. For internet access, the router connects to an external network (`external-network`), and a public IP address is allocated, through which the router will perform 1:1 NAT. The router's public IP address does not change while the router is connected to the internet.

You cannot access devices behind the router from the internet using the router's external IP address. It is only used for devices to access the internet through the router.

To configure access to devices from the internet, use a public IP address or a public subnet; for more details, see the [Configure access to the internet and from the internet](/cloud-servers/cloud-networks/configure-access-to-internet.mdx) guide.

<Tabs queryString="connect-cloud-router-to-internet">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Network** → **Cloud Routers** tab.
    3. In the  cloud router menu, select **Connect to Internet**.<MoreVerticalIcon />
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Connect the cloud router to the internet:

       ```bash
       openstack router set --external-gateway external-network <router>
       ```

       Specify `<router>` — the cloud router ID or name, which can be viewed using the `openstack router list` command.
  </TabItem>
</Tabs>

## Disconnect a cloud router from the internet \{#disconnect-cloud-router-from-internet}

If you disconnect a cloud router from the internet, its external IP address is returned to the IP pool. After reconnecting, the IP address will change.

A cloud router cannot be disconnected from the internet if it is processing traffic for public IP addresses.

<Tabs queryString="disconnect-cloud-router-from-internet">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Network** section → **Cloud Routers** tab.
    3. In the  cloud router menu, select **Disconnect from Internet**.<MoreVerticalIcon />
    4. Click **Disconnect**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Disconnect the cloud router from the internet:

       ```bash
       openstack router unset --external-gateway <router>
       ```

       Specify `<router>` — the cloud router ID or name, which can be viewed using the `openstack router list` command.
  </TabItem>
</Tabs>

## Assign a firewall to a cloud router port \{#assign-firewall-to-cloud-router-port}

:::warning

Incoming and outgoing traffic that is not permitted by cloud firewall rules will be denied at the cloud router port. Active sessions on the router that cannot be established under the new rules will be terminated.

:::

You cannot assign more than one firewall to a single router port.

<Tabs queryString="assign-firewall-to-cloud-router-port">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Network** section → **Cloud Routers** tab.
    3. Open the cloud router page.
    4. In the row of the private subnet port for which you need to configure traffic filtering, in the **Firewall** field, click .<EditIcon />
    5. Select a firewall.
    6. Click **Save**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Assign a firewall to a cloud router port:

       ```bash
       openstack firewall group set --port <router_port> <firewall>
       ```

       Specify:

       * `<router_port>` — the ID or name of the router port to which the firewall will be assigned; it can be viewed using the `openstack port list` command. To assign a firewall to multiple router ports, list their IDs or names separated by a space;
       * `<firewall>` — the firewall ID or name, which can be viewed using the `openstack firewall group list` command.
  </TabItem>
</Tabs>

## Disable firewall on a cloud router port \{#disconnect-firewall-from-cloud-router-port}

:::warning

Cloud firewall rules will stop applying — all incoming and outgoing traffic passing through the cloud router port will be permitted.

:::

<Tabs queryString="disconnect-firewall-from-cloud-router-port">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Network** section → **Cloud Routers** tab.
    3. Open the router page.
    4. In the row of the private subnet port for which traffic filtering was configured, in the **Firewall** field, click .<EditIcon />
    5. Select **No firewall**.
    6. Click **Save**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Disable firewall on a router port:

       ```bash
       openstack firewall group unset --port <router_port> <firewall>
       ```

       Specify:

       * `<router_port>` — the ID or name of the router port from which the firewall will be removed; it can be viewed using the `openstack port list`;
       * `<firewall>` — the firewall ID or name, which can be viewed using the `openstack firewall group list` command.
  </TabItem>
</Tabs>

## Enable a cloud router \{#enable-cloud-router}

<Tabs queryString="enable-cloud-router">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Network** section → **Cloud Routers** tab.
    3. In the cloud router card, enable the router.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Enable the cloud router:

       ```bash
       openstack router set --enable <router>
       ```

       Specify `<router>` — the router ID or name, which can be viewed using the `openstack router list` command.
  </TabItem>
</Tabs>

## Disable a cloud router \{#disable-cloud-router}

A router cannot be turned off if it is processing traffic for a [public IP address](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx).

<Tabs queryString="disable-cloud-router">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Network** section → **Cloud Routers** tab.
    3. In the cloud router card, disable the router.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Disable the cloud router:

       ```bash
       openstack router set --disable <router>
       ```

       Specify `<router>` — the cloud router ID or name, which can be viewed using the `openstack router list` command.
  </TabItem>
</Tabs>

## Delete a cloud router \{#delete-cloud-router}

<Tabs queryString="delete-cloud-router">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/routers/), on the top menu, click **Products** and select **Cloud Servers**.

    2. Go to the **Network** section → **Cloud Routers** tab.

    3. Disconnect all connected subnets from the router; to do this, delete the ports of all subnets from the router:

       3.1. Open the router page →  **Ports** tab.

       3.2. In the row of any port, click .<TrashIcon />

       3.3. Click **Delete**.

       3.4. Repeat steps 3.2–3.3 for all remaining ports.

    4. In the  router menu, select **Delete router**.<MoreVerticalIcon />

    5. Click **Delete**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. If subnets are connected to the router, delete the router ports:

       ```bash
       openstack router remove port <router> <port_id>
       ```

       Specify:

       * `<router>` — the cloud router ID or name, which can be viewed using the `openstack router list`;
       * `<port_id>` — the ID of the port connected to the router, which can be viewed using the `openstack port list --router <router>`.

    3. Delete the router:

       ```bash
       openstack router delete <router>
       ```
  </TabItem>
</Tabs>

<Formbricks />