diff --git a/common/src/api/external/mod.rs b/common/src/api/external/mod.rs
index 9ce5e6ce465..93c9727b0a8 100644
--- a/common/src/api/external/mod.rs
+++ b/common/src/api/external/mod.rs
@@ -1675,6 +1675,9 @@ pub enum RouteTarget {
     #[display("inetgw:{0}")]
     /// Forward traffic to an internet gateway
     InternetGateway(Name),
+    #[display("drop")]
+    /// Drop matching traffic
+    Drop,
 }
 
 /// A `RouteDestination` is used to match traffic with a routing rule, on the
diff --git a/illumos-utils/src/opte/port_manager.rs b/illumos-utils/src/opte/port_manager.rs
index 03c51c321df..d6b4963607c 100644
--- a/illumos-utils/src/opte/port_manager.rs
+++ b/illumos-utils/src/opte/port_manager.rs
@@ -25,6 +25,7 @@ use oxide_vpc::api::IpCidr;
 use oxide_vpc::api::Ipv4Cfg;
 use oxide_vpc::api::Ipv6Cfg;
 use oxide_vpc::api::MacAddr;
+use oxide_vpc::api::RouterClass;
 use oxide_vpc::api::RouterTarget;
 use oxide_vpc::api::SNat4Cfg;
 use oxide_vpc::api::SNat6Cfg;
@@ -339,9 +340,16 @@ impl PortManager {
             (port, ticket)
         };
 
+        // TODO: These should not be filled in like this, and should be informed
+        //       by either our existing knowledge of current knowledge of system + custom
+        //       routers OR we just await the router RPW filling this in for us.
+        //       In future, ∃ VPCs *without* an Internet Gateway so we can't just
+        //       plumb that in as well...
+
         // Add a router entry for this interface's subnet, directing traffic to the
         // VPC subnet.
         let route = AddRouterEntryReq {
+            class: RouterClass::System,
             port_name: port_name.clone(),
             dest: vpc_subnet,
             target: RouterTarget::VpcSubnet(vpc_subnet),
@@ -378,6 +386,7 @@ impl PortManager {
         .parse()
         .unwrap();
         let route = AddRouterEntryReq {
+            class: RouterClass::System,
             port_name: port_name.clone(),
             dest,
             target: RouterTarget::InternetGateway,
diff --git a/nexus/db-model/src/schema.rs b/nexus/db-model/src/schema.rs
index 3d16b978f62..73f23ea4053 100644
--- a/nexus/db-model/src/schema.rs
+++ b/nexus/db-model/src/schema.rs
@@ -1100,6 +1100,7 @@ table! {
         rcgen -> Int8,
         ipv4_block -> Inet,
         ipv6_block -> Inet,
+        custom_router_id -> Nullable<Uuid>,
     }
 }
 
diff --git a/nexus/db-model/src/schema_versions.rs b/nexus/db-model/src/schema_versions.rs
index 5a263ea5368..377a85f01b9 100644
--- a/nexus/db-model/src/schema_versions.rs
+++ b/nexus/db-model/src/schema_versions.rs
@@ -17,7 +17,7 @@ use std::collections::BTreeMap;
 ///
 /// This must be updated when you change the database schema.  Refer to
 /// schema/crdb/README.adoc in the root of this repository for details.
-pub const SCHEMA_VERSION: SemverVersion = SemverVersion::new(61, 0, 0);
+pub const SCHEMA_VERSION: SemverVersion = SemverVersion::new(62, 0, 0);
 
 /// List of all past database schema versions, in *reverse* order
 ///
@@ -29,6 +29,7 @@ static KNOWN_VERSIONS: Lazy<Vec<KnownVersion>> = Lazy::new(|| {
         // |  leaving the first copy as an example for the next person.
         // v
         // KnownVersion::new(next_int, "unique-dirname-with-the-sql-files"),
+        KnownVersion::new(62, "vpc-subnet-routing"),
         KnownVersion::new(61, "blueprint-add-sled-state"),
         KnownVersion::new(60, "add-lookup-vmm-by-sled-id-index"),
         KnownVersion::new(59, "enforce-first-as-default"),
diff --git a/nexus/db-model/src/vpc_subnet.rs b/nexus/db-model/src/vpc_subnet.rs
index 407c933ef2c..5c85c8a6dc5 100644
--- a/nexus/db-model/src/vpc_subnet.rs
+++ b/nexus/db-model/src/vpc_subnet.rs
@@ -39,6 +39,7 @@ pub struct VpcSubnet {
     pub rcgen: Generation,
     pub ipv4_block: Ipv4Net,
     pub ipv6_block: Ipv6Net,
+    pub custom_router_id: Option<Uuid>,
 }
 
 impl VpcSubnet {
@@ -60,6 +61,7 @@ impl VpcSubnet {
             rcgen: Generation::new(),
             ipv4_block: Ipv4Net(ipv4_block),
             ipv6_block: Ipv6Net(ipv6_block),
+            custom_router_id: None,
         }
     }
 
@@ -102,6 +104,7 @@ impl From<VpcSubnet> for views::VpcSubnet {
             vpc_id: subnet.vpc_id,
             ipv4_block: subnet.ipv4_block.0,
             ipv6_block: subnet.ipv6_block.0,
+            custom_router_id: subnet.custom_router_id,
         }
     }
 }
diff --git a/nexus/db-queries/src/db/datastore/vpc.rs b/nexus/db-queries/src/db/datastore/vpc.rs
index 91843abf2ea..d0c4e381adc 100644
--- a/nexus/db-queries/src/db/datastore/vpc.rs
+++ b/nexus/db-queries/src/db/datastore/vpc.rs
@@ -74,7 +74,8 @@ impl DataStore {
     ) -> Result<(), Error> {
         use crate::db::fixed_data::project::SERVICES_PROJECT_ID;
         use crate::db::fixed_data::vpc::SERVICES_VPC;
-        use crate::db::fixed_data::vpc::SERVICES_VPC_DEFAULT_ROUTE_ID;
+        use crate::db::fixed_data::vpc::SERVICES_VPC_DEFAULT_V4_ROUTE_ID;
+        use crate::db::fixed_data::vpc::SERVICES_VPC_DEFAULT_V6_ROUTE_ID;
 
         opctx.authorize(authz::Action::Modify, &authz::DATABASE).await?;
 
@@ -135,35 +136,41 @@ impl DataStore {
                 .map(|(authz_router, _)| authz_router)?
         };
 
-        let route = RouterRoute::new(
-            *SERVICES_VPC_DEFAULT_ROUTE_ID,
-            SERVICES_VPC.system_router_id,
-            RouterRouteKind::Default,
-            nexus_types::external_api::params::RouterRouteCreate {
-                identity: IdentityMetadataCreateParams {
-                    name: "default".parse().unwrap(),
-                    description:
-                        "Default internet gateway route for Oxide Services"
-                            .to_string(),
+        // Unwrap safety: these are known valid CIDR blocks.
+        let default_ips = [
+            ("0.0.0.0/0".parse().unwrap(), *SERVICES_VPC_DEFAULT_V4_ROUTE_ID),
+            ("::/0".parse().unwrap(), *SERVICES_VPC_DEFAULT_V6_ROUTE_ID),
+        ];
+
+        for (default, uuid) in default_ips {
+            let route = RouterRoute::new(
+                uuid,
+                SERVICES_VPC.system_router_id,
+                RouterRouteKind::Default,
+                nexus_types::external_api::params::RouterRouteCreate {
+                    identity: IdentityMetadataCreateParams {
+                        name: "default".parse().unwrap(),
+                        description:
+                            "Default internet gateway route for Oxide Services"
+                                .to_string(),
+                    },
+                    target: RouteTarget::InternetGateway(
+                        "outbound".parse().unwrap(),
+                    ),
+                    destination: RouteDestination::IpNet(default),
                 },
-                target: RouteTarget::InternetGateway(
-                    "outbound".parse().unwrap(),
-                ),
-                destination: RouteDestination::Vpc(
-                    SERVICES_VPC.identity.name.clone().into(),
-                ),
-            },
-        );
-        self.router_create_route(opctx, &authz_router, route)
-            .await
-            .map(|_| ())
-            .or_else(|e| match e {
-                Error::ObjectAlreadyExists { .. } => Ok(()),
-                _ => Err(e),
-            })?;
+            );
+            self.router_create_route(opctx, &authz_router, route)
+                .await
+                .map(|_| ())
+                .or_else(|e| match e {
+                    Error::ObjectAlreadyExists { .. } => Ok(()),
+                    _ => Err(e),
+                })?;
+        }
 
         self.load_builtin_vpc_fw_rules(opctx).await?;
-        self.load_builtin_vpc_subnets(opctx).await?;
+        self.load_builtin_vpc_subnets(opctx, &authz_router).await?;
 
         info!(opctx.log, "created built-in services vpc");
 
@@ -228,10 +235,14 @@ impl DataStore {
     async fn load_builtin_vpc_subnets(
         &self,
         opctx: &OpContext,
+        authz_router: &authz::VpcRouter,
     ) -> Result<(), Error> {
         use crate::db::fixed_data::vpc_subnet::DNS_VPC_SUBNET;
+        use crate::db::fixed_data::vpc_subnet::DNS_VPC_SUBNET_ROUTE_ID;
         use crate::db::fixed_data::vpc_subnet::NEXUS_VPC_SUBNET;
+        use crate::db::fixed_data::vpc_subnet::NEXUS_VPC_SUBNET_ROUTE_ID;
         use crate::db::fixed_data::vpc_subnet::NTP_VPC_SUBNET;
+        use crate::db::fixed_data::vpc_subnet::NTP_VPC_SUBNET_ROUTE_ID;
 
         debug!(opctx.log, "attempting to create built-in VPC Subnets");
 
@@ -242,9 +253,11 @@ impl DataStore {
             .lookup_for(authz::Action::CreateChild)
             .await
             .internal_context("lookup built-in services vpc")?;
-        for vpc_subnet in
-            [&*DNS_VPC_SUBNET, &*NEXUS_VPC_SUBNET, &*NTP_VPC_SUBNET]
-        {
+        for (vpc_subnet, route_id) in [
+            (&*DNS_VPC_SUBNET, *DNS_VPC_SUBNET_ROUTE_ID),
+            (&*NEXUS_VPC_SUBNET, *NEXUS_VPC_SUBNET_ROUTE_ID),
+            (&*NTP_VPC_SUBNET, *NTP_VPC_SUBNET_ROUTE_ID),
+        ] {
             if let Ok(_) = db::lookup::LookupPath::new(opctx, self)
                 .vpc_subnet_id(vpc_subnet.id())
                 .fetch()
@@ -260,6 +273,31 @@ impl DataStore {
                     Error::ObjectAlreadyExists { .. } => Ok(()),
                     _ => Err(e),
                 })?;
+
+            let route = RouterRoute::new(
+                route_id,
+                *SERVICES_VPC_ID,
+                RouterRouteKind::Default,
+                nexus_types::external_api::params::RouterRouteCreate {
+                    identity: IdentityMetadataCreateParams {
+                        name: "default".parse().unwrap(),
+                        description:
+                            "Default internet gateway route for Oxide Services"
+                                .to_string(),
+                    },
+                    target: RouteTarget::Subnet(vpc_subnet.name().clone()),
+                    destination: RouteDestination::Subnet(
+                        vpc_subnet.name().clone(),
+                    ),
+                },
+            );
+            self.router_create_route(opctx, &authz_router, route)
+                .await
+                .map(|_| ())
+                .or_else(|e| match e {
+                    Error::ObjectAlreadyExists { .. } => Ok(()),
+                    _ => Err(e),
+                })?;
         }
 
         info!(opctx.log, "created built-in services vpc subnets");
diff --git a/nexus/db-queries/src/db/fixed_data/vpc.rs b/nexus/db-queries/src/db/fixed_data/vpc.rs
index c71b655ddc9..6dffc114267 100644
--- a/nexus/db-queries/src/db/fixed_data/vpc.rs
+++ b/nexus/db-queries/src/db/fixed_data/vpc.rs
@@ -24,11 +24,19 @@ pub static SERVICES_VPC_ROUTER_ID: Lazy<uuid::Uuid> = Lazy::new(|| {
 });
 
 /// UUID of default route for built-in Services VPC.
-pub static SERVICES_VPC_DEFAULT_ROUTE_ID: Lazy<uuid::Uuid> = Lazy::new(|| {
-    "001de000-074c-4000-8000-000000000002"
-        .parse()
-        .expect("invalid uuid for builtin services vpc default route id")
-});
+pub static SERVICES_VPC_DEFAULT_V4_ROUTE_ID: Lazy<uuid::Uuid> =
+    Lazy::new(|| {
+        "001de000-074c-4000-8000-000000000002"
+            .parse()
+            .expect("invalid uuid for builtin services vpc default route id")
+    });
+
+pub static SERVICES_VPC_DEFAULT_V6_ROUTE_ID: Lazy<uuid::Uuid> =
+    Lazy::new(|| {
+        "001de000-074c-4000-8000-000000000003"
+            .parse()
+            .expect("invalid uuid for builtin services vpc default route id")
+    });
 
 /// Built-in VPC for internal services on the rack.
 pub static SERVICES_VPC: Lazy<db::model::IncompleteVpc> = Lazy::new(|| {
diff --git a/nexus/db-queries/src/db/fixed_data/vpc_subnet.rs b/nexus/db-queries/src/db/fixed_data/vpc_subnet.rs
index c42d4121c90..45db9b7e0b8 100644
--- a/nexus/db-queries/src/db/fixed_data/vpc_subnet.rs
+++ b/nexus/db-queries/src/db/fixed_data/vpc_subnet.rs
@@ -31,6 +31,24 @@ pub static NTP_VPC_SUBNET_ID: Lazy<uuid::Uuid> = Lazy::new(|| {
         .expect("invalid uuid for builtin boundary ntp vpc subnet id")
 });
 
+pub static DNS_VPC_SUBNET_ROUTE_ID: Lazy<uuid::Uuid> = Lazy::new(|| {
+    "001de000-c470-4000-8000-000000000004"
+        .parse()
+        .expect("invalid uuid for builtin services vpc default route id")
+});
+
+pub static NEXUS_VPC_SUBNET_ROUTE_ID: Lazy<uuid::Uuid> = Lazy::new(|| {
+    "001de000-c470-4000-8000-000000000005"
+        .parse()
+        .expect("invalid uuid for builtin services vpc default route id")
+});
+
+pub static NTP_VPC_SUBNET_ROUTE_ID: Lazy<uuid::Uuid> = Lazy::new(|| {
+    "001de000-c470-4000-8000-000000000006"
+        .parse()
+        .expect("invalid uuid for builtin services vpc default route id")
+});
+
 /// Built-in VPC Subnet for External DNS.
 pub static DNS_VPC_SUBNET: Lazy<VpcSubnet> = Lazy::new(|| {
     VpcSubnet::new(
diff --git a/nexus/src/app/sagas/vpc_create.rs b/nexus/src/app/sagas/vpc_create.rs
index 6b48e4087ad..e78c67600b0 100644
--- a/nexus/src/app/sagas/vpc_create.rs
+++ b/nexus/src/app/sagas/vpc_create.rs
@@ -13,6 +13,7 @@ use nexus_db_queries::{authn, authz, db};
 use nexus_defaults as defaults;
 use omicron_common::api::external;
 use omicron_common::api::external::IdentityMetadataCreateParams;
+use omicron_common::api::external::IpNet;
 use omicron_common::api::external::LookupType;
 use omicron_common::api::external::RouteDestination;
 use omicron_common::api::external::RouteTarget;
@@ -44,14 +45,22 @@ declare_saga_actions! {
         + svc_create_router
         - svc_create_router_undo
     }
-    VPC_CREATE_ROUTE -> "route" {
-        + svc_create_route
-        - svc_create_route_undo
+    VPC_CREATE_V4_ROUTE -> "route4" {
+        + svc_create_v4_route
+        - svc_create_v4_route_undo
+    }
+    VPC_CREATE_V6_ROUTE -> "route6" {
+        + svc_create_v6_route
+        - svc_create_v6_route_undo
     }
     VPC_CREATE_SUBNET -> "subnet" {
         + svc_create_subnet
         - svc_create_subnet_undo
     }
+    VPC_CREATE_SUBNET_ROUTE -> "route" {
+        + svc_create_subnet_route
+        - svc_create_subnet_route_undo
+    }
     VPC_UPDATE_FIREWALL -> "firewall" {
         + svc_update_firewall
         - svc_update_firewall_undo
@@ -79,8 +88,18 @@ pub fn create_dag(
         ACTION_GENERATE_ID.as_ref(),
     ));
     builder.append(Node::action(
-        "default_route_id",
-        "GenerateDefaultRouteId",
+        "default_v4_route_id",
+        "GenerateDefaultV4RouteId",
+        ACTION_GENERATE_ID.as_ref(),
+    ));
+    builder.append(Node::action(
+        "default_v6_route_id",
+        "GenerateDefaultV6RouteId",
+        ACTION_GENERATE_ID.as_ref(),
+    ));
+    builder.append(Node::action(
+        "default_subnet_route_id",
+        "GenerateDefaultV6RouteId",
         ACTION_GENERATE_ID.as_ref(),
     ));
     builder.append(Node::action(
@@ -90,8 +109,10 @@ pub fn create_dag(
     ));
     builder.append(vpc_create_vpc_action());
     builder.append(vpc_create_router_action());
-    builder.append(vpc_create_route_action());
+    builder.append(vpc_create_v4_route_action());
+    builder.append(vpc_create_v6_route_action());
     builder.append(vpc_create_subnet_action());
+    builder.append(vpc_create_subnet_route_action());
     builder.append(vpc_update_firewall_action());
     builder.append(vpc_notify_sleds_action());
 
@@ -217,8 +238,44 @@ async fn svc_create_router_undo(
     Ok(())
 }
 
+// XX: possibly do these as a subsaga?
+
+async fn svc_create_v4_route(
+    sagactx: NexusActionContext,
+) -> Result<(), ActionError> {
+    let default_route_id = sagactx.lookup::<Uuid>("default_v4_route_id")?;
+    let default_route =
+        "0.0.0.0/0".parse().expect("known-valid specifier for a default route");
+    svc_create_route(sagactx, default_route_id, default_route).await
+}
+
+async fn svc_create_v4_route_undo(
+    sagactx: NexusActionContext,
+) -> Result<(), anyhow::Error> {
+    let route_id = sagactx.lookup::<Uuid>("default_v4_route_id")?;
+    svc_create_route_undo(sagactx, route_id).await
+}
+
+async fn svc_create_v6_route(
+    sagactx: NexusActionContext,
+) -> Result<(), ActionError> {
+    let default_route_id = sagactx.lookup::<Uuid>("default_v6_route_id")?;
+    let default_route =
+        "::/0".parse().expect("known-valid specifier for a default route");
+    svc_create_route(sagactx, default_route_id, default_route).await
+}
+
+async fn svc_create_v6_route_undo(
+    sagactx: NexusActionContext,
+) -> Result<(), anyhow::Error> {
+    let route_id = sagactx.lookup::<Uuid>("default_v6_route_id")?;
+    svc_create_route_undo(sagactx, route_id).await
+}
+
 async fn svc_create_route(
     sagactx: NexusActionContext,
+    route_id: Uuid,
+    default_net: IpNet,
 ) -> Result<(), ActionError> {
     let osagactx = sagactx.user_data();
     let params = sagactx.saga_params::<Params>()?;
@@ -226,12 +283,11 @@ async fn svc_create_route(
         &sagactx,
         &params.serialized_authn,
     );
-    let default_route_id = sagactx.lookup::<Uuid>("default_route_id")?;
     let system_router_id = sagactx.lookup::<Uuid>("system_router_id")?;
     let authz_router = sagactx.lookup::<authz::VpcRouter>("router")?;
 
     let route = db::model::RouterRoute::new(
-        default_route_id,
+        route_id,
         system_router_id,
         RouterRouteKind::Default,
         params::RouterRouteCreate {
@@ -240,9 +296,7 @@ async fn svc_create_route(
                 description: "The default route of a vpc".to_string(),
             },
             target: RouteTarget::InternetGateway("outbound".parse().unwrap()),
-            destination: RouteDestination::Vpc(
-                params.vpc_create.identity.name.clone(),
-            ),
+            destination: RouteDestination::IpNet(default_net),
         },
     );
 
@@ -256,6 +310,7 @@ async fn svc_create_route(
 
 async fn svc_create_route_undo(
     sagactx: NexusActionContext,
+    route_id: Uuid,
 ) -> Result<(), anyhow::Error> {
     let osagactx = sagactx.user_data();
     let params = sagactx.saga_params::<Params>()?;
@@ -264,7 +319,6 @@ async fn svc_create_route_undo(
         &params.serialized_authn,
     );
     let authz_router = sagactx.lookup::<authz::VpcRouter>("router")?;
-    let route_id = sagactx.lookup::<Uuid>("default_route_id")?;
     let authz_route = authz::RouterRoute::new(
         authz_router,
         route_id,
@@ -370,6 +424,61 @@ async fn svc_create_subnet_undo(
     Ok(())
 }
 
+async fn svc_create_subnet_route(
+    sagactx: NexusActionContext,
+) -> Result<(), ActionError> {
+    let osagactx = sagactx.user_data();
+    let params = sagactx.saga_params::<Params>()?;
+    let opctx = crate::context::op_context_for_saga_action(
+        &sagactx,
+        &params.serialized_authn,
+    );
+    let system_router_id = sagactx.lookup::<Uuid>("system_router_id")?;
+    let authz_router = sagactx.lookup::<authz::VpcRouter>("router")?;
+    let route_id = sagactx.lookup::<Uuid>("default_subnet_route_id")?;
+
+    let route = db::model::RouterRoute::new(
+        route_id,
+        system_router_id,
+        RouterRouteKind::Default,
+        params::RouterRouteCreate {
+            identity: IdentityMetadataCreateParams {
+                name: "default".parse().unwrap(),
+                description: "The default route of a vpc".to_string(),
+            },
+            target: RouteTarget::Subnet("default".parse().unwrap()),
+            destination: RouteDestination::Subnet("default".parse().unwrap()),
+        },
+    );
+
+    osagactx
+        .datastore()
+        .router_create_route(&opctx, &authz_router, route)
+        .await
+        .map_err(ActionError::action_failed)?;
+    Ok(())
+}
+
+async fn svc_create_subnet_route_undo(
+    sagactx: NexusActionContext,
+) -> Result<(), anyhow::Error> {
+    let osagactx = sagactx.user_data();
+    let params = sagactx.saga_params::<Params>()?;
+    let opctx = crate::context::op_context_for_saga_action(
+        &sagactx,
+        &params.serialized_authn,
+    );
+    let authz_router = sagactx.lookup::<authz::VpcRouter>("router")?;
+    let route_id = sagactx.lookup::<Uuid>("default_subnet_route_id")?;
+    let authz_route = authz::RouterRoute::new(
+        authz_router,
+        route_id,
+        LookupType::ById(route_id),
+    );
+    osagactx.datastore().router_delete_route(&opctx, &authz_route).await?;
+    Ok(())
+}
+
 async fn svc_update_firewall(
     sagactx: NexusActionContext,
 ) -> Result<Vec<db::model::VpcFirewallRule>, ActionError> {
diff --git a/nexus/src/external_api/http_entrypoints.rs b/nexus/src/external_api/http_entrypoints.rs
index 0b09e2c9ab8..d3cbcd432a4 100644
--- a/nexus/src/external_api/http_entrypoints.rs
+++ b/nexus/src/external_api/http_entrypoints.rs
@@ -4871,7 +4871,6 @@ async fn vpc_firewall_rules_update(
     method = GET,
     path = "/v1/vpc-routers",
     tags = ["vpcs"],
-    unpublished = true,
 }]
 async fn vpc_router_list(
     rqctx: RequestContext<Arc<ServerContext>>,
@@ -4907,7 +4906,6 @@ async fn vpc_router_list(
     method = GET,
     path = "/v1/vpc-routers/{router}",
     tags = ["vpcs"],
-    unpublished = true,
 }]
 async fn vpc_router_view(
     rqctx: RequestContext<Arc<ServerContext>>,
@@ -4937,7 +4935,6 @@ async fn vpc_router_view(
     method = POST,
     path = "/v1/vpc-routers",
     tags = ["vpcs"],
-    unpublished = true,
 }]
 async fn vpc_router_create(
     rqctx: RequestContext<Arc<ServerContext>>,
@@ -4969,7 +4966,6 @@ async fn vpc_router_create(
     method = DELETE,
     path = "/v1/vpc-routers/{router}",
     tags = ["vpcs"],
-    unpublished = true,
 }]
 async fn vpc_router_delete(
     rqctx: RequestContext<Arc<ServerContext>>,
@@ -4999,7 +4995,6 @@ async fn vpc_router_delete(
     method = PUT,
     path = "/v1/vpc-routers/{router}",
     tags = ["vpcs"],
-    unpublished = true,
 }]
 async fn vpc_router_update(
     rqctx: RequestContext<Arc<ServerContext>>,
@@ -5035,7 +5030,6 @@ async fn vpc_router_update(
     method = GET,
     path = "/v1/vpc-router-routes",
     tags = ["vpcs"],
-    unpublished = true,
 }]
 async fn vpc_router_route_list(
     rqctx: RequestContext<Arc<ServerContext>>,
@@ -5073,7 +5067,6 @@ async fn vpc_router_route_list(
     method = GET,
     path = "/v1/vpc-router-routes/{route}",
     tags = ["vpcs"],
-    unpublished = true,
 }]
 async fn vpc_router_route_view(
     rqctx: RequestContext<Arc<ServerContext>>,
@@ -5101,12 +5094,11 @@ async fn vpc_router_route_view(
     apictx.external_latencies.instrument_dropshot_handler(&rqctx, handler).await
 }
 
-/// Create router
+/// Create route
 #[endpoint {
     method = POST,
     path = "/v1/vpc-router-routes",
     tags = ["vpcs"],
-    unpublished = true,
 }]
 async fn vpc_router_route_create(
     rqctx: RequestContext<Arc<ServerContext>>,
@@ -5138,7 +5130,6 @@ async fn vpc_router_route_create(
     method = DELETE,
     path = "/v1/vpc-router-routes/{route}",
     tags = ["vpcs"],
-    unpublished = true,
 }]
 async fn vpc_router_route_delete(
     rqctx: RequestContext<Arc<ServerContext>>,
@@ -5170,7 +5161,6 @@ async fn vpc_router_route_delete(
     method = PUT,
     path = "/v1/vpc-router-routes/{route}",
     tags = ["vpcs"],
-    unpublished = true,
 }]
 async fn vpc_router_route_update(
     rqctx: RequestContext<Arc<ServerContext>>,
diff --git a/nexus/types/src/external_api/views.rs b/nexus/types/src/external_api/views.rs
index 1e90d04b55b..cb05f85930b 100644
--- a/nexus/types/src/external_api/views.rs
+++ b/nexus/types/src/external_api/views.rs
@@ -258,7 +258,7 @@ pub struct Vpc {
 }
 
 /// A VPC subnet represents a logical grouping for instances that allows network traffic between
-/// them, within a IPv4 subnetwork or optionall an IPv6 subnetwork.
+/// them, within a IPv4 subnetwork or optionally an IPv6 subnetwork.
 #[derive(ObjectIdentity, Clone, Debug, Deserialize, Serialize, JsonSchema)]
 pub struct VpcSubnet {
     /// common identifying metadata
@@ -273,6 +273,9 @@ pub struct VpcSubnet {
 
     /// The IPv6 subnet CIDR block.
     pub ipv6_block: Ipv6Net,
+
+    /// ID for an attached custom router.
+    pub custom_router_id: Option<Uuid>,
 }
 
 #[derive(Clone, Copy, Debug, Deserialize, Serialize, PartialEq, JsonSchema)]
diff --git a/schema/crdb/dbinit.sql b/schema/crdb/dbinit.sql
index e66f28d74f6..47022bba3f8 100644
--- a/schema/crdb/dbinit.sql
+++ b/schema/crdb/dbinit.sql
@@ -1364,7 +1364,9 @@ CREATE TABLE IF NOT EXISTS omicron.public.vpc_subnet (
     /* Child resource creation generation number */
     rcgen INT8 NOT NULL,
     ipv4_block INET NOT NULL,
-    ipv6_block INET NOT NULL
+    ipv6_block INET NOT NULL,
+    /* nullable FK to the `vpc_router` table. */
+    custom_router_id UUID
 );
 
 /* Subnet and network interface names are unique per VPC, not project */
@@ -1620,6 +1622,7 @@ CREATE TABLE IF NOT EXISTS omicron.public.router_route (
     /* Indicates that the object has been deleted */
     time_deleted TIMESTAMPTZ,
 
+    /* FK to the `vpc_router` table. */
     vpc_router_id UUID NOT NULL,
     kind omicron.public.router_route_kind NOT NULL,
     target STRING(128) NOT NULL,
@@ -3856,7 +3859,7 @@ INSERT INTO omicron.public.db_metadata (
     version,
     target_version
 ) VALUES
-    (TRUE, NOW(), NOW(), '61.0.0', NULL)
+    (TRUE, NOW(), NOW(), '62.0.0', NULL)
 ON CONFLICT DO NOTHING;
 
 COMMIT;
diff --git a/schema/crdb/vpc-subnet-routing/up01.sql b/schema/crdb/vpc-subnet-routing/up01.sql
new file mode 100644
index 00000000000..d1869dd010b
--- /dev/null
+++ b/schema/crdb/vpc-subnet-routing/up01.sql
@@ -0,0 +1,3 @@
+-- Each subnet may have a custom router attached.
+ALTER TABLE omicron.public.vpc_subnet
+ADD COLUMN IF NOT EXISTS custom_router_id UUID;