Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to perform few changes to a running VM's MAC address and obtain new IP address. Currently the VMs are connected to the outside network through the host's bridge interface. I would like to temporarily (10-20 seconds) block the VM's network connection from the host machine except for the packets relating to dhcp.

Is it possible?

share|improve this question
up vote 1 down vote accepted

Sure, you can either disconnect the VM from the host network, or just apply relevant iptables or ebtables rules to block packets from going anywhere.

Without more details of how your network is setup, it's impossible to give you more detailed commands, but they're all basic administrative tasks.

share|improve this answer
Ok great.... Now the VM communicates through the host's bridge interface. Please let me know what information you need. Moreover, I want to know whether it is possible to block the VM's network without blocking the dhcp packet which is required for acquiring a new IP ? Thanks for the info. – sethu Aug 14 '11 at 4:53
Add relevant information to your question, not comments. – womble Aug 14 '11 at 5:07
Sorry , I will add that information with the question now. – sethu Aug 14 '11 at 5:08

If you are using bridged networking for the VM, simply remove the VM's interface from the bridge adapter, perform the changes, then add it back. If the host is linux os, you need the bridge-utils package installed (probably it is already). Run this:

brctl show

to see what bridge devices are up and running, identify your bridge name and your VM network adapter, then remove it from bridge:

brctl delif brdev0 vmdev0 

Do what you need to do on the VM and when you're done, add it back to the bridge:

brctl addif brdev0 vmdev0

PS: the above commands should be ran as root.

share|improve this answer
But this will not give vms the capability to send dhcp packet over the network right ! The best solution for me will be like filtering it out from iptables and let dhcp packets alone to pass through it for initial few minutes. But I am not sure about the rules. – sethu Aug 14 '11 at 5:17
Err, do you mean that you should re-phrase your question to: "Can you give pointers to basic IP tables HOWTOs/tutorials? – snap Aug 14 '11 at 6:28
No , After getting your answers , I feel iptables will be my best solution and removing it from the bridge will not let me send the dhcp packet out. Please correct me if I am wrong. – sethu Aug 16 '11 at 14:05

I assume your point is to find a way to apply filters per a specific VM instance from the host side? Applying the filters to the host's outgoing interface is not different from any normal iptables setup, but then the VM's will be able to communicate between each other unfiltered.

Have you tried applying normal iptables and ebtables rules to the corresponding vnetNNN interfaces in the host? I have not tried it myself but I think there is a good chance that it would work.

If you are using libvirt to manage your QEMU/KVM instances, you can do virsh dumpxml VMNAME and look for a line such as <target dev='vnet0'/> to see the relevant vnet interface.

share|improve this answer
Yeah the interface is vnet0. – sethu Aug 16 '11 at 14:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.