How would I make a network topology on KVM analogous to the internal network configuration on virtualbox?

Question

The differences in documentation between KVM docs and virtualbox docs make it difficult to find what I'm looking for

My goal is to do something like https://resources.infosecinstitute.com/topic/setting-pentest-lab-pfsense-virtualbox/ where all guests have IPs assigned by the pfSense guest, which also acts like a firewall between them and can itself be accessed by the host network. In this way I can practice having a host blocking access between my attacking machine and the target.

The libvirt docs don't really go into it, I think https://wiki.libvirt.org/page/VirtualNetworking

What exactly am I missing? I'm having a hard time trying to figure out what I don't know that I don't know, so I can't really tell

related: Bridging of Internal Network in KVM

Answer 1

I guess there is two solutions.

the first is to use a second Ethernet port, bridge it to your hypervisor and bind your "inside" VM to this bridge, but do not link your second Ethernet to your original LAN (it has to be isolated)

the second solution if you do not have a second Ethernet port is to simulate one Eternet isolated LAN using for example the dummy kernel module.

example in your /ets/network/interfaces :

auto vmbr2
iface vmbr2 inet manual
    bridge_ports dummy0
    bridge_stp off
    bridge_fd 0
    pre-up modprobe dummy numdummies=4

and so you bind this bridge to your hypervisor and your "inside" VM to this bridge as well as your pfsense.