cloudparts

OVN (Open Virtual Network)

A control plane for virtual networks built on Open vSwitch: you describe logical switches, routers, ACLs, NAT and load balancers, and it programs the OVS on every host to implement them.

Linux Foundation project
What it is
Software-defined networking
Type
Open source
Made by
OVN project (Linux Foundation), started by the Open vSwitch developers
Foundation
The Linux Foundation, joined November 2019. A series of LF Projects, LLC, split out of the Open vSwitch repository in 2019
License
Apache 2.0
Facts checked
28 October 2026
Website Source code

What it is

Open vSwitch forwards packets by OpenFlow rules, but a cloud wants to think in networks, subnets, routers and security groups. OVN fills that gap. It is a set of daemons that turn a description of logical networks into OpenFlow rules for the Open vSwitch on each host, and it supplies the pieces a cloud network needs: distributed logical switches and routers, ACLs for security groups, NAT, load balancers, DHCP, a DNS responder, and gateways that connect logical networks to physical ones. Logical networks run as overlays in tunnels between hosts, so their address spaces can overlap with each other and with the physical network, and a VM can move between hosts without changing its addresses.

OVN is layered around two OVSDB databases. A cloud management system, through its own plugin, writes the desired topology into the Northbound database, in terms such as logical switches, ports and ACLs. ovn-northd translates that into logical flows, a description of the pipeline every packet goes through, and writes them into the Southbound database, which also records the chassis (hypervisors and gateways) and which logical port lives where. An ovn-controller on every chassis reads the Southbound database and programs its local Open vSwitch, so routing and ACLs run on the host where a packet starts rather than on a central router. It is written in C and runs entirely in user space.

The big users are OpenStack, whose Neutron service ships an ML2/OVN driver that became DevStack’s default in May 2021, and Kubernetes through OVN-Kubernetes, a CNCF Sandbox project since October 2024 and the default network plugin in Red Hat OpenShift. OVN is versioned by year and month with releases in March and September: 26.09 is the latest and 26.03 the current long-term support series. Recent releases added dynamic routing over BGP and EVPN, so logical routers can announce their routes to the physical fabric. OVN has been a Linux Foundation project, a series of LF Projects, LLC, since November 2019.

Why teams pick it

  • Turns Open vSwitch into a full virtual network: switches, routers, ACLs, NAT, load balancing and DHCP without separate appliances
  • Distributed by design: each host routes and filters its own VMs’ and pods’ traffic, so there is no central router to bottleneck
  • Shared by OpenStack and OpenShift, so fixes and scale work from both communities land in one code base
  • Clear interfaces: anything that can write the Northbound database can drive it, and the logical flows can be inspected and traced

Watch out for

  • The central databases and ovn-northd must be run as a highly available cluster, and at large scale their size and recompute time need tuning
  • Needs Open vSwitch on every host, and a version pairing between OVN, OVS and the cloud’s plugin that has to be planned at upgrades
  • Debugging spans several layers: Northbound objects, logical flows, OpenFlow rules and datapath flows, each with its own tools
  • Standard-term releases get only a year of fixes, so production users usually stay on the long-term support series

Alternatives

What all software-defined networking have in common →Compare side by side →
OpenDaylightOpen sourceAn open-source SDN controller in Java: it models networks and devices in YANG, talks to them over NETCONF, BGP, PCEP, OpenFlow, gNMI and more, and exposes it all as a RESTCONF API.

How it fits with other technologies

A logical switch, a router port and an ACL in the Northbound database, then binding a VM on a host · bash

ovn-nbctl ls-add web
ovn-nbctl lsp-add web web-vm1
ovn-nbctl lsp-set-addresses web-vm1 "00:00:00:00:00:01 10.0.0.11"

# a logical router with an interface on the switch
ovn-nbctl lr-add r1
ovn-nbctl lrp-add r1 r1-web 00:00:00:00:ff:01 10.0.0.1/24
ovn-nbctl lsp-add web web-r1
ovn-nbctl lsp-set-type web-r1 router
ovn-nbctl lsp-set-addresses web-r1 router
ovn-nbctl lsp-set-options web-r1 router-port=r1-web

# only HTTPS reaches the VM
ovn-nbctl acl-add web to-lport 1000 'outport == "web-vm1" && tcp.dst == 443' allow-related
ovn-nbctl acl-add web to-lport 900 'outport == "web-vm1"' drop

# on the hypervisor: tie the VM's OVS interface to its logical port
ovs-vsctl set interface tap1 external_ids:iface-id=web-vm1

See it in a real stack

No architecture uses OVN (Open Virtual Network) yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2015–2026

By 2014 Open vSwitch was widely used as the switch in open-source clouds, but each cloud and controller built its own way of turning tenants’ networks into OVS rules. On 13 January 2015 Justin Pettit, Ben Pfaff, Chris Wright and Madhu Venugopal announced OVN, a native virtual networking layer for OVS developed in the OVS repository, aimed at layer 2 and layer 3 overlays and security groups, with OpenStack as its first user.

In 2019 OVN moved into its own repository and release cycle, and on 4 November 2019 it was established as a series of LF Projects, LLC, with a charter and a technical steering committee of its committers. From 20.03 in March 2020 it has been versioned by year and month. OpenStack made ML2/OVN DevStack’s default Neutron backend in May 2021, and Red Hat made OVN-Kubernetes the default network plugin in OpenShift, removing the older OpenShift SDN plugin in 4.17.

OVN-Kubernetes was accepted into the CNCF Sandbox in October 2024. OVN itself kept growing towards the physical network, adding dynamic routing with BGP and EVPN, and released 26.03 as a long-term support series in March 2026 and 26.09 in September 2026.

Why it’s built this way

Databases as the interfaces between layers
Each layer writes its state to an OVSDB database and the next one reads it, so components can restart or scale independently and anyone can inspect the intended state.
Logical flows between the model and OpenFlow
Compiling the network once into logical flows, then letting each host translate them locally, keeps the central work independent of how many hosts there are and lets hosts apply only what concerns them.
Distributed routing and filtering on every host
Applying logical routers and ACLs on the host where a packet starts means traffic between VMs doesn’t detour through a central router, and capacity grows with the number of hosts.

Timeline

  1. 2015

    OVN announced by Open vSwitch developers on 13 January

  2. 2019

    Own repository; becomes an LF Projects series on 4 November

  3. 2020

    20.03 in March, the first year-and-month version

  4. 2021

    ML2/OVN becomes DevStack’s default Neutron backend in May

  5. 2024

    OVN-Kubernetes accepted into the CNCF Sandbox in October

  6. 2026

    26.03 long-term support release in March; 26.09 in September

Sources10 · facts checked 28 October 2026

Improve this page on GitHub