I installed Ubuntu 14.04 server a week ago. I use it as a virtual machine host (tasksel installed). meaning am running it with kvm + libvirt.

I have set up the same bridge I had in 13.10.

auto p4p1
iface p4p1 inet manual
    up ifconfig $IFACE up
    down ifconfig $IFACE down

auto br0
iface br0 inet static
    address 46.182.xxx.xxx
    gateway 46.182.xxx.xxx
    dns-nameservers 46.182.xxx.xxx 46.182.xxx.xxx
    bridge_ports p4p1
    bridge_stp off
    bridge_maxwait 0

iface br0 inet6 auto

Against br0 I connect my virtual machines with <source bridge='br0'/> defined in libvirt.

My virtual machines get Router Advertisement messages without problem. All virtual machines get IPv6 addresses.

My problem is that IPv6 does not work over the bridge. But it does work when I turn on tcpdump against br0 for troubleshooting. I have tried setting the interface manually into promiscous mode but that does not make it work, ifconfig br0 promisc.

Why I have the IPv4 addresses on the bridge? I do not know, old habit, never question it. IPv6 does not work on the virtual machine host but the host get IPv6 address by RA, just like the virtual machines.

  • 1
    If the VMs get IPv6 addresses that means there are IPv6 packets going over the bridge from the network to the VM. Otherwise the VMs wouldn't see the router advertisements. Is there any firewalling or filtering on the bridge? May 4, 2014 at 9:05
  • This is standard ubuntu 14.04 server that I have installed and then added "virtual machine host" with tasksel. There is no firewall activated that I know of. iptables -L is clean. May 4, 2014 at 12:51
  • IPv6 uses ip6tables. Can you check that one as well? May 4, 2014 at 19:49
  • ip6tables -L is clean May 5, 2014 at 4:54
  • 1
    Hmmm. Weird. All I can think of right now is to run tcpdump/wireshark/tshark on the interfaces to see where the packets get stuck. May 5, 2014 at 13:43

3 Answers 3


Every IPv6 address, even link-local ones, automatically subscribe to a multicast group based on its last 24 bits. If multicast snooping is enabled, the bridge filters out (almost) all multicast traffic by default. When an IPv6 address is assigned to an interface, the system must inform the network that this interface is interested in that particular multicast group and must be excluded by the filter. The following is a good introductory video: https://www.youtube.com/watch?v=O1JMdjnn0ao

Multicast snooping is there to prevent flooding the network with multicast packets that most systems aren't interested. You can disable multicast snooping in small deployments without noticing any big difference. But this may have significant performance impact on larger deployments.

You can disable snooping with:

echo -n 0 > /sys/class/net/<brif>/bridge/multicast_snooping

If you want to protect your VMs from unwanted traffic and unnecessary packet processing, you can leave snooping enabled but also enable a multicast Querier on the network. A Querier will periodically broadcast query packets and update snooping filters on switches and bridges. It is possible to enable a Querier on your system with:

echo -n 1 > /sys/class/net/<brif>/bridge/multicast_querier

If you have snooping enabled, you must also have a querier on the network.

There's no need to enable STP. It's probably safer to turn it off, unless you know that you're bridging segments that result in circular paths. It's also irrelevant if you have SLAAC enabled (ie autoconf=1, accept_ra=1). Enabling PROMISC mode on the bridge implicitly disables snooping.

Here's a nice summary of the modern challenges of IPv6 Neighbor Discovery (ND) and Multicast Listener Discovery (MLD).


have you enabled IPv6 on the interface at all? if the bridge device is br0, then do this:

sysctl net.ipv6.conf.br0.disable_ipv6=0
sysctl net.ipv6.conf.br0.autoconf=1
sysctl net.ipv6.conf.br0.accept_ra=1
sysctl net.ipv6.conf.br0.accept_ra_defrtr=1
  • sysctl net.ipv6.conf.br0.accept_ra=1 is 0 as default. I can not test this because I switched to separated physical interface on the server and then it started to work. So I can not troubleshoot this anymore. Meaning, I have sysctl net.ipv6.conf.br0.accept_ra=0 and it still works for my vhosts. Jul 7, 2014 at 9:51
  • 1
    This is the right answer. Aug 27, 2015 at 13:07

The only obvious problem I see with your configuration is:

    bridge_stp off

For various reasons STP needs to be enabled on libvirt bridges.

Change the configuration to:

    bridge_stp on

You can also activate it immediately without restarting the network:

$ sudo brctl stp br0 on

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .