I have two debian9.1-VMs running on one KVM host.
If they are both on VLAN1, I can ssh from one VM to the other.
If they are both on another VLAN, they can ping but can't ssh each other.
If there is a third VM in that VLAN on another KVM host, this VM can ssh the other two VMs and they can ssh that VM.

What is the reason, why ssh is not working, if the VMs are running on the same hypervisor?
And what do I have to change on the KVM host for letting the VMs on it connect to each other - without having the KVM host in that VLAN too?

As a test I did a fresh installation of debian9.1. Then:

apt-get install vlan
modprobe 8021q
echo "8021q" >>/etc/modules

After that, I modified /etc/network/interfaces on the VMs like this:

allow-hotplug ens3
#iface ens3 inet dhcp
auto ens3.23
iface ens3.23 inet static
  address   # .12 / .21 on the other ones
  vlan-raw-device ens3

Now the VMs are tagging all packets for VLAN23. I can see these tags on my switch, if there was communication between the VMs on the different KVM hosts.

And the result is: (VMs .11 and .12 are on KVM1, .21 is on KVM2)

.11 <-> .12 ==> no connect
.11 <-> .21 ==> connect
.12 <-> .21 ==> connect

EDIT: it's no longer important. I found a workaround.
The NICs were on virtio.
After setting them to rtl8139 everything is fine ... and now it's possible to ssh from one VM to another - even if they are running on the same hypervisor.


switching to an old emulated NIC doesn't solve a problem.

Actually, if your VMs are on different VLANs they shouldn't be able to communicate at all, and the fact that they do is an obvious bug.

Having said that, the correct way of tagging VMs isn't inside the VM itself, it's by creating tagged interfaces on the host, creating bridges ot top of those tagged interfaces (so you have something like a tagged v-switch) and plugging the VMs into those tagged bridges.

  • My three VMs are not in different VLANs - they are all in VLAN23. Why should it be the correct way, to do all the tagging on the hypervisor? What's the benefit of doing it the hard way? – dede Aug 11 '17 at 16:14
  • on the host create ethX.23, build a bridge on top of it and connect all your VMs into that bridge with no tagging inside the VM. Use virtio, always. – dyasny Aug 11 '17 at 16:17
  • There is nothing hard about it. Losing the ability to run PV is hard. But it's your setup, you can do whatever you want, all I can do is point you to the best practice. – dyasny Aug 11 '17 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.