I'm using debian 10 with kvm/qemu as hypervisor. You can ignore the bond...

I created X VLAN Tagged and created a bridge on that tagged vlan.

auto bond0
iface bond0 inet manual
        slaves eno1 eno2
        bond-mode 4

auto bond0.10
iface bond0.10 inet manual
        vlan-raw-device bond0

auto br10
iface br10 inet static
        bridge_ports bond0.10
        bridge_stp off

The problem is now, that through this "design", the guest cannot access the host... What would be an better design? I want to have following design

Gatway - Host - Guest

So there is no way the guest can access to host.

Currently its like:

Gatway - Host - Guest

Is there a "better" thing as only to deny via firewall?

Is vSwitch an idea?

  • OK now it makes sense. But you have used a bridge and so your VMs are literally on the same network segment as the host. The way you prevent access is with your host firewall, the same as for any other machine. Aug 11, 2021 at 13:12
  • @MichaelHampton I updated my question. Would be nice if you can give a look....
    – Wulf
    Aug 12, 2021 at 9:27
  • What did you mean by several different systems (gateway and guest) having same IP address ( inside a single Ethernet segment? How it supposed to work? Aug 12, 2021 at 10:56
  • @NikitaKipriyanov Each guest should be in a VLAN ID X (192.168.X.10) and Gateway has a address for each vlan. But I want to tag the vlan in the host so that the guest has untagged vlan
    – Wulf
    Aug 12, 2021 at 11:00
  • 1
    Fix the question then. Now it is very misleading, specifying the same address .1 for both. Aug 12, 2021 at 11:06


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.