0

Thanks for listening.

I've followed some guidance here and elsewhere, believing I've got the setup correct, but my guests just can't see past the host (ie the internet) and I can't ping into any of the ports on the guests.

Unless I've got it totally wrong, I thought that was what bridging would give me! Hoping to give all the relevant information...

libvirt network default.xml...

<network>
  <name>default</name>
  <uuid>64acadc1-0c41-4cf5-850e-01bcfe5ad7ba</uuid>
  <forward mode='route'/>
  <bridge name='br0' stp='on' delay='0'/>
  <mac address='52:54:00:54:b1:e4'/>
  <ip address='192.168.0.2' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.0.3' end='192.168.0.254'/>
      <host mac='52:54:00:13:3a:69' name='node1' ip='192.168.0.201'/>
      <host mac='52:54:00:92:af:91' name='node2' ip='192.168.0.202'/>
      <host mac='52:54:00:bb:4b:6d' name='node3' ip='192.168.0.203'/>
      <host mac='52:54:00:e3:4b:4a' name='node4' ip='192.168.0.204'/>
    </dhcp>
  </ip>
</network>

Guest xml...

<interface type='bridge'>
  <mac address='52:54:00:13:3a:69'/>
  <source bridge='br0'/>
</interface>

ifconfig on the host...

br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 192.168.0.2  netmask 255.255.255.0  broadcast 192.168.0.255
    ether 52:54:00:54:b1:e4  txqueuelen 1000  (Ethernet)
    RX packets 552  bytes 41699 (41.6 KB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 240  bytes 26714 (26.7 KB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

enp3s0f0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 192.168.1.13  netmask 255.255.255.0  broadcast 192.168.1.255
    inet6 fe80::2e76:8aff:fea9:7e5e  prefixlen 64  scopeid 0x20<link>
    ether 2c:76:8a:a9:7e:5e  txqueuelen 1000  (Ethernet)
    RX packets 3679  bytes 1174123 (1.1 MB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 4101  bytes 410899 (410.8 KB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ifconfig on the guest...

ens3  Link encap:Ethernet  HWaddr 52:54:00:13:3a:69
      inet addr:192.168.0.201  Bcast:192.168.0.255  Mask:255.255.255.0
      inet6 addr: fe80::5054:ff:fe13:3a69/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:191 errors:0 dropped:0 overruns:0 frame:0
      TX packets:335 errors:0 dropped:0 overruns:0 carrier:0
      collisions:1605 txqueuelen:1000
      RX bytes:22402 (22.4 KB)  TX bytes:34822 (34.8 KB)

lo    Link encap:Local Loopback
      inet addr:127.0.0.1  Mask:255.0.0.0
      inet6 addr: ::1/128 Scope:Host
      UP LOOPBACK RUNNING  MTU:65536  Metric:1
      RX packets:8530 errors:0 dropped:0 overruns:0 frame:0
      TX packets:8530 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1
      RX bytes:1766049 (1.7 MB)  TX bytes:1766049 (1.7 MB)

brctl show...

bridge name     bridge id               STP enabled     interfaces
br0             8000.52540054b1e4       yes             br0-nic

netstat -rn...

Kernel IP routing table
Destination   Gateway       Genmask         Flags  MSS Window  irtt Iface
0.0.0.0       192.168.1.1   0.0.0.0         UG       0 0          0 enp3s0f0
192.168.0.0   0.0.0.0       255.255.255.0   U        0 0          0 br0
192.168.1.0   0.0.0.0       255.255.255.0   U        0 0          0 enp3s0f0
192.168.1.1   0.0.0.0       255.255.255.255 UH       0 0          0 enp3s0f0

The guests can ping the host and they can ping each other.

  • 1
    Don't you want your bridge and guests IPs to be on the 192.168.1,X sub-net? – Doug Smythies Dec 13 '17 at 22:19
  • Well I assumed the bridge would re-direct my 192.168.0 sub-net to it. The KVM default "default" network as 192.168.122.x (don't ask me why I changed it - dunno!) – Jus Dec 13 '17 at 22:33
0

Currently, you have your bridge and quests on a different sub-net than your main sub-net. So, no your quests do not have internet access, because there is no path to your gateway. Put everything on the same sub-net. Examples from my main host computer:

Main host ifconfig. Notice how enp3s0 doesn't even show an IP address. That is because it is bridged to br0, and both have the same IP address. Ignore lxcbr0 and virbr0, they are not part of this discussion, nor do I use them (shown for completeness only).

doug@s15:~$ ifconfig
br0       Link encap:Ethernet  HWaddr f4:6d:04:65:2d:8e
          inet addr:192.168.111.112  Bcast:192.168.111.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4574 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2604 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:509690 (509.6 KB)  TX bytes:425082 (425.0 KB)

enp3s0    Link encap:Ethernet  HWaddr f4:6d:04:65:2d:8e
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4574 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2604 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:573726 (573.7 KB)  TX bytes:426090 (426.0 KB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:174 errors:0 dropped:0 overruns:0 frame:0
          TX packets:174 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:12644 (12.6 KB)  TX bytes:12644 (12.6 KB)

lxcbr0    Link encap:Ethernet  HWaddr 00:16:3e:00:00:00
          inet addr:10.0.3.1  Bcast:0.0.0.0  Mask:255.255.255.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

virbr0    Link encap:Ethernet  HWaddr 52:54:00:21:9e:43
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Here is my main hosts interfaces file, where br0 is bridged to enp3s0:

doug@s15:~$ cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface and bridge
auto br0
iface br0 inet dhcp
#iface br0 inet static
#  address 192.168.111.112
#  network 192.168.111.0
#  netmask 255.255.255.0
#  gateway 192.168.111.1
#  broadcast 192.168.111.255
#  dns-search smythies.com
#  dns-nameservers 192.168.111.1
  bridge_ports enp3s0
  bridge_fd 9
  bridge_hello 2
  bridge_maxage 12
  bridge_stp off

And here is the network section of a typical guest. I assign the MAC because I assign IP addresses from my DHCP server based on MAC, and then my DNS stuff works the way I want.

<interface type='bridge'>
  <mac address='52:54:00:14:ff:9c'/>
  <source bridge='br0'/>
  <model type='virtio'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>

And here is the routing. Everything on my LAN is on the 192.168.111.XXX sub-net, and therefore there is path to/from the gateway via br0:

doug@s15:~$ netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.111.1   0.0.0.0         UG        0 0          0 br0
10.0.3.0        0.0.0.0         255.255.255.0   U         0 0          0 lxcbr0
192.168.111.0   0.0.0.0         255.255.255.0   U         0 0          0 br0
192.168.122.0   0.0.0.0         255.255.255.0   U         0 0          0 virbr0
  • Ok, thx Doug I will try that. Could I ask what your network default.xml file looks like please? And to check you can access all ports on your guests from the rest of your sub-net (ie not just the host and other guests, but all other computers)? – Jus Dec 13 '17 at 22:51
  • Yes, I can access all ports on all guests from anywhere on my LAN, which is one of the major reasons to bridge. As far as I know my /etc/libvirt/qemu/default.xml file is the default, but I don't care because I override it and my quests use the bridge and get their IP address from my DHCP server. – Doug Smythies Dec 13 '17 at 23:33
  • So there is still something amiss! After adding br0 on the same sub-net and doing an ifconfig I get my physical NIC showing the same inet address as br0, indicating bridging not working. Can't cut'n'paste the output as I can't SSH to the host in this state. – Jus Dec 17 '17 at 21:46
  • Some progress.... disabled ipv6 and now I can ping the internet (forgot to mention this above), but still can't ssh to host. ufw is disabled and I flushed all the iptables rules – Jus Dec 17 '17 at 22:24
  • 1
    @Jus : If my answer helped you, then perhaps accept it or upvote it. – Doug Smythies Dec 18 '17 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.