Hi! Thanks for your answer. Unfortunately, this confused me even more and let’s me think that I fundamentally misunderstand something here.
All my subnets I create as a user are fully routed outside of OVN automatically. In my router, “2001:XXXX:XXXX::/48” is routed to VLAN33 so I do not have to deal with any of that manual configuration.
This is the network config used to create the incus cluster:
network:
LOCAL:
type: macvlan
local_config:
parent: enp2s0
description: Directly attach to host networking
UPLINK:
type: physical
config:
ipv4.gateway: "192.168.33.1/24"
ipv4.ovn.ranges: "192.168.33.20-192.168.33.99"
ipv6.gateway: "2001:XXXX:XXXX::0001/48"
ipv6.routes: '::/0'
local_config:
parent: eno1
description: Physical network for OVN routers
default:
type: ovn
config:
network: UPLINK
ipv6.address: "2001:XXXX:XXXX:0001::0001/64"
#dns.nameservers: 2001:4860:4860::8888,8.8.8.8,2001:4860:4860::8844,8.8.4.4
default: true
description: Initial OVN network
And inside every project I create the uplink network for that project with terraform and with a dedicated range from the /48 block:
resource “incus_network” “incus_network” {
count = length(incus_project.incus_project)
project = “${element(incus_project.incus_project.*.name, count.index)}”
name = “UPLINK”
description = “Public network”
type = “ovn”
config = {
# automatically configure UPLINK network range
“ipv6.address” = “${var.ipv6_48_block}:${count.index + 1}00::1/64”
“network” = “UPLINK”
“bridge.mtu” = “1380”
}
}
That is the only uplink network the project should get and users should only be able to additional networks from private IP ranges.
I tried to use restricted.networks.subnets here, but it does not work like I intended to. Project users can no longer create their own networks but rather only those wich match the name of the networks listed in this flag.
If they want to create e.g. two “192.168.0.1/16” networks, I need to add e.g. UPLINK1:192.168.0.0/16,UPLINK2:192.168.0.0/16 to the subnet restrictions which also means they cannot pick the names themselfs any more.
Also, adding the subnet restriction only works, when there are routes for these private networks in the uplink, but I intend that there are no routes. It should be a LAN network for the project.
The scale is quite small: 3 NUC machines with 32GB RAM each and 8 cores. I try to create a lab environment at home (thus the MTU of 1380) for some friends to get a playground for cloud stuff. The /48 block comes from tunnelbroker.net’s 6in4 tunnel, so I cheat myself static IPs on my consumer internect connection 
.
