How to set up Static Routes for direct IP use in VDC

Set up the static route in the NSX edge

The following is a guide on how to use static routes in the NSX to use public IPs directly on VMs in your VDC.  This will bypass the need for SNAT and allow public IPs to be assigned directly to VMs.

Create routed network in NSX

First, you will need to create a routed local network for the VMs to use.  The VMs will get a local IP in this network, and the public IP will route to this local IP.  The public IP will also be assigned to the interface of the VM in a later step.

In VDC go to “Networks” → “New”

In Scope, select “Current Organization Virtual Data Center”

Create the network as a Routed network

Select the Primary Edge.  This is the metered edge, and it has the public IPs assigned to it.

In the next window you must name the network, and assign a gateway/cidr for the network.  I am using the 10.1.1.0/24 network in this example.  Due to this the gateway will be 10.1.1.1, so the Gateway CIDR will be 10.1.1.1/24.

In the next window, optionally set the usable IPs in this range.  In our example this will be 10.1.1.2-10.1.1.254.

Optionally set the DNS for the network.  Our resolvers are 221.121.130.3 and 221.121.134.9.

Click next on the “Segment Profile Template” section without selecting a template.  This will not be needed.

Click “Finish” on the final window.  This will create the network.

Set the network on VM NICs

Edit a VM that will need to use the routed network.  Go to NICs, and select EDIT.

Click “ADD NETWORK TO VAPP”

Select “Direct”, and select the routed network you created.  Click “ADD”.

Under the “Network” dropdown box, select the network you have added.  Under “IP Mode” select “Static - Manual”.  Under “IP” enter the IP address that you will use.  Click “SAVE”.

On the Windows VM in this example I am setting this to 10.1.1.4.  There will be two other Linux VMs, one Ubuntu, and one AlmaLinux that will use other IPs in this range.

This has added the network to the VM.  We will configure the network in the VM’s OS in a later step.

Create static route in NSX

In VDC go to “Edges”, then your primary metered edge.

Go to IP Allocations, and take note of the available public IPs.  You will use these in your static routes in the NSX edge.

In this example I will be making 3 static routes.  One for a Windows VM, one for a Ubuntu VM, and one for an AlmaLinux VM.

The following are the IPs that I will use in this example for the static routes.

In the Edge go to “Routing” → “Static Routes”, and click “NEW”.

Add a name and a description for the route you are creating.  The network is a /32 of the public IP.  See the image below as an example.

Click on “Next Hops” at the top.

Under “IP Address” add the local IP from the routed network that the public IP will route to.  Under “Scope” select the routed network that we created earlier.  Click Save.

Perform this for each static route that needs to be created for your VMs.

Create firewall rule in NSX

In order for your VMs to communicate outbound via the public IP, create an IP Set with the public IPs in it, then use this to create an allow rule for outbound communication.

First, create the IP set by going to “Security” → “IP Sets” and click “NEW”

Name the IP Set and add all the public IPs that you will be using.

Now that the IP Set is created you can use this in a firewall rule to allow outbound communication.

Go to “Services” → “Firewall” and click “NEW”

Name the Firewall rule.  Click the pencil near ‘Source”, select the public IP Set you created.  Click the pencil near Destination and select ANY.

Click “Save” near the bottom to create the allow rule.

Ensure that there are NO SNAT or DNAT rules using the public IP

If there are any NAT rules currently using the public IP the routing will not work.  Go into the NAT rules on the edge and remove any NAT rules that reference the public IP

Set up the IP address in Linux

Setting up the network in Ubuntu based distros

In Ubuntu the network is setup using netplan.  There will be a YAML file for the netplan config in /etc/netplan.  Edit the config file in /etc/netplan and ensure that the public IP and local IP are both in addresses, as well as a routes section that not only has the default route, but also a from section that specifies the public IP.

Here is an example of the netplan config I have for the VM in this guide.

network:
  version: 2
  renderer: networkd
  ethernets:
    ens160:
      dhcp4: no
      dhcp6: no
      addresses:
        - 118.127.48.220/32
        - 10.1.1.2/24
      routes:
        - to: default
          via: 10.1.1.1
          from: 118.127.48.220
      nameservers:
        addresses:
          - 221.121.130.3
          - 221.121.134.9

Note that the important changes to the default YAML file are in addresses and routes .

Be sure to run netplan apply to apply the new configuration.

Setting up the network in RHEL based distros

Modern RHEL based distros, like AlmaLinux, use Network Manager for the IP configuration.  You will first need to use nmtui to add the public IP and the local IP to the interfaces IP addresses.  Type nmtui to bring up the configuration wizard.  Select “Edit a connection”.

Select your interface an select edit.  In this example the interface is ens192 .

Edit the IPs in “Addresses” so that the Public IP and the local IP are both present.

Select “OK” at the bottom, then “Back” in the interface select window.  Finally select “Quit” to save and apply the changes.

ip a should now show both the IPs on the interface.

Next you need to create a new route that has a lower metric value and the public IP as the source.

Here is the command for this example.  You may need to adjust this to use the IPs that you are assigning to the interface, and the interface name that you are using.

nmcli connection modify "ens192" ipv4.routes "0.0.0.0/0 10.1.1.1 10 src=118.127.48.221"

Next run the following to apply the change

nmcli device reapply ens192

This will create a default route for 0.0.0.0/0 to use the gateway 10.1.1.1 with a metric of 10 and the source IP of 118.127.48.221.

If you run ip r you should see the following route.

Set up the IP address in Windows

Add IPs to interface

In the OS for Windows, search for “Control Panel” and open up the control panel.

Go to “Network and Internet”

Go to “Network and Sharing Center”

Click “Change adapter settings”

Right click on the interface and go to “Properties”

Go to “Internet Protocol Version 4 (TCP/IPv4)” and click “Properties”

Ensure that the local IP address from the routed network is set, and also the routed networks gateway.

Click “Advanced…” near the bottom.

Click “Add…” under “IP addresses”

Add in the public IP as a /32

Set primary IP to public IP

Run the following command in PowerShell, using the local IP for routing in the command.  In this example the local IP for routing is 10.1.1.4, but this will vary based on how the VM was set up in previous steps.

Get-NetIPAddress | Where-Object { $_.IPAddress -eq "10.1.1.4" } | Set-NetIPAddress -SkipAsSource $true

This will tell the OS to skip the local routing IP as the source IP, and use the assigned public IP for network operations.