The differences in documentation between KVM docs and virtualbox docs make it difficult to find what I'm looking for

My goal is to do something like https://resources.infosecinstitute.com/topic/setting-pentest-lab-pfsense-virtualbox/ where all guests have IPs assigned by the pfSense guest, which also acts like a firewall between them and can itself be accessed by the host network. In this way I can practice having a host blocking access between my attacking machine and the target.

The libvirt docs don't really go into it, I think https://wiki.libvirt.org/page/VirtualNetworking

What exactly am I missing? I'm having a hard time trying to figure out what I don't know that I don't know, so I can't really tell

related: Bridging of Internal Network in KVM

  • You did not see "Isolated mode"? Aug 12, 2021 at 21:33
  • You can create a bridge on the host without enslaving a NIC to it and assigning any address on it (and disable ipv6 link-local addressing with sysctl). You can further prevent communication between the host and the VMs with the input (and output) hook / chain of an nftables bridge table / ebtables. (The forward hook / chain governs traffics from one tap to another.)
    – Tom Yan
    Aug 15, 2021 at 11:18

1 Answer 1


I guess there is two solutions.

the first is to use a second Ethernet port, bridge it to your hypervisor and bind your "inside" VM to this bridge, but do not link your second Ethernet to your original LAN (it has to be isolated)

the second solution if you do not have a second Ethernet port is to simulate one Eternet isolated LAN using for example the dummy kernel module.

example in your /ets/network/interfaces :

auto vmbr2
iface vmbr2 inet manual
    bridge_ports dummy0
    bridge_stp off
    bridge_fd 0
    pre-up modprobe dummy numdummies=4

and so you bind this bridge to your hypervisor and your "inside" VM to this bridge as well as your pfsense.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .