I'm looking at ordering a powerful server machine to use for virtualization. I'm planning on running debian with KVM+QEMU for the virtualization, and a hardware RAID6 to store the VMs on. I would also like to be able to use the same IP to route to different VMs, depending on stuff like domain or port, since my co-location provider takes an extra fee per extra IP I need.

What is the best practices to achieve this? Or if you have some general tips and tricks for this kind of setup? I assume I need some kind of firewall to do the routing, but should I create a bridge device conencted to a physical interface to put the VMs on, or should I stick to the virtual bridge that is created automagically?

Any help is appreciated!

I apologize if this question is too general, but I did not know where else to post it.

  • Be sure to get yourself some IPv6. May 29 '13 at 17:30

Keep your guest network interfaces with private IPs in an internal bridge, configure iptables on the host to NAT an port on its external interface, to an IP and port in the internal bridge.

For example, say your host's internet IP is Setup a bridge (we'll call it virbr0) and give the host an IP in this bridge like When you create a new virtual guest, bridge its network interface into virbr0 and give the guest OS an IP address within On the host, create a NAT which directs something like to To ssh to that guest from outside, you ssh to the external port on the host.

You'll also need an outgoing NAT rule so that guests use as their default gateway, and the host takes any requests from guests and NATs them out its external interface.

Incoming NAT (called a DNAT) is covered at:

Outgoing NAT (called MASQUERADE) is covered at:

  • You're thinking of SNAT. MASQUERADE is a variant of SNAT that's used when the public IP address is dynamic and may change unexpectedly, such as residential ISP connections. May 30 '13 at 2:29
  • That does sound pretty good actually, thanks a bunch for that! However, iptables cannot be used to route based on what domain was used if I reacall correctly. Is there some tool around that does that, or should I really just stick to iptables and solve that some other way?
    – Mikau
    May 30 '13 at 5:52
  • 1
    Also for HTTP stuff I suggest a reverse proxy setup, with a minimal HTTP server on the host to do the routing to one or more backends. May 30 '13 at 9:06
  • I don't quite understand what you mean about routing and domains. Are you doing something with DNS, like hosting a different website on every guest? You want to be able to go "example1.com" or "example2.com", both of which have their A record pointing towards the host's public IP, and have the firewall decide which guest to direct the traffic to? No, iptables cannot do this. You might be able to setup an iptables -u32 match to capture the domain name in HTTP requests, but I wouldn't rely on it. Luca's suggestion of a reverse proxy on the host is the right way to do this.
    – suprjami
    May 30 '13 at 11:48
  • Yep, you got it right, and yeah, Luca's suggestion sounds like the way to go.
    – Mikau
    May 30 '13 at 12:17

I guess avoiding a bridge and using host-only networking with routing makes the configuration easier to understand.

If the guests are Linux systems then I recommend to configure them with a serial console (which can be accessed by virsh console $domain).


If you're planning on using libvirt to manage kvm, read Red Hat's Virtualization Administration Guide (RHEL 6) or Virtualization Deployment and Administration Guide (RHEL 7). It will be useful even on Debian.

  • Thanks, I hadn't found that one yet, seems like it contains quite a bit of useful info!
    – Mikau
    May 30 '13 at 5:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.