I need help designing networking for virtualized guests using KVM. My machine is running CentOS 7 and has 2 NICs. I'd like to achieve the following

  • One physical interface (em1) shall be used for host access only. The host will have a pretty normal configuration with untagged traffic and a static IP address.
  • The other physical interface (em2) receives tagged traffic for different VLANs.
  • The virtual machines shall only see the traffic for their specific VLAN. Inter-Guest communication is not required to be done within the KVM.
  • I would prefer the traffic on the virtual NIC to be untagged, to make sure that the guest doesn't change its internal NIC config to spoof other networks.

Link to concept graphic

I am new to libvirt and also not used to Network Manager. I searched for documentation but found conflicting information, starting with the question whether it is possible to configure this bridging via network manager. I also read about the possibility to let the KVM do the switching.

I would be grateful for either direct configuration help or a pointer to an up-to-date documentation that does not use (on CentOS 7) deprecated tools or workarounds for problems removed in the meantime.

Thanks in advance.

  • Could you switch to Proxmox? It provides all of your requirement. – jasonz Nov 2 '15 at 16:19

What you want, while usefull, is not very straighfoward to do. Basically, you have 3 possibilities:

  1. use the Open vSwitch stack to virtualize the bridge/switch
  2. use dedicated software bridge for each vlan
  3. on recent kernels it is possible to use the "bridge VLAN filter" feature to have a single "intelligent" bridge to rule them all

Solution n.1 is (probably) the most complete, but the most difficult to setup.

Solution n.2 is what I adopted for my lab test. For example, for VLAN 10 and 20, you had do create a similar setup:

eth0 (physical interface) -> eth0.10 (VLAN tagged) -> br10 (bridge with eth0.10 and the relative virtual qemu/kvm interface)
eth0 (physical interface) -> eth0.20 (VLAN tagged) -> br20 (bridge with eth0.20 and the relative virtual qemu/kvm interface)

Please note that if you need to have untagged traffic also on the tagged bridge, you must issue the following ebtables rule: ebtables -t broute -A BROUTING -i eth0 -p 802.1Q -j DROP This rule is needed due to how the Linux networking stack manage incoming packets. For more information, see here, here and here

Solution n.3 should be the clever one, but you need kernel support for it (and libvirt also). CentOS7 should have a sufficient recent kernel, but I don't know if all other software pieces are ready.

Solution n.4 (bonus one): if you don't need guest/host communication, give a look at the macvtap driver. While I don't use it, you should be able to setup a similar solution:

eth0 (physical interface) -> eth0.10 (VLAN tagged) -> MAC vtap on eth0.10
eth0 (physical interface) -> eth0.20 (VLAN tagged) -> MAC vtap on eth0.20

For me, the impossibility to communicate from/to guest/host is too much of a limitation, but your requirement may be different.

Finally, have a look here, it's worth reading.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.