I have a physical/dedicated server which is running Debian 9 (Stretch). The server has enough resources to support its own load and the load of some virtual machines (in this question: Windows Server 2016 Standard edition).

To simplify this question, I will use Debian host to refer to the physical/dedicated server which is running Debian 9 (Stretch), and Windows VM to refer to the (currently not implemented) Windows Server 2016 Standard edition virtual machine that runs on the Debian host.

The Debian host uses KVM/QEMU/virsh to provide virtualization capability and its configuration. The Debian host currently does not have any virtual machines (or networks) configured. The Debian host only has one physical network card (NIC) which is mapped to the network interface eth0. The Debian host itself provides various services that the Debian host also should provide, when it's hosting additional virtual machines.

The Debian host should (scope of this question) host one Windows VM. The Debian host and its services should be able to access the Windows VM via a private IPv4 network/address. The Windows VM should be able to access the Debian host by the same IPv4 network (private IPv4 address of the Debian host). The Windows VM should not be accessible via a public IPv4 or IPv6 network/address. The Windows VM should be able to access the Internet (outgoing connections). The Windows VM should not have a public IPv4 or IPv6 network/address assigned to it. A proxy on the Debian host should proxy specific incoming connections to the private IPv4 address of the Windows VM.

The Debian host should further (relevant for this question) be able to host further virtual machines (other Debian instances). All the virtual machines on the Debian host should be isolated from each other. Meaning Debian host can reach all of the VMs, all VMs can reach Debian host and Internet, but the VMs cannot reach each other (directly).

I found some concepts about VM networking. However, I could not find a solution that matches my needs. The closest (but not matching) concept I could find was: Bridge networking. With this, the Windows VM would be connected "to the Internet". This is not desired. The other concepts (NAT, Host-only) either don't allow Host -> Guest or Guest -> Internet access.

My question is: Is my planned network design possible with one virtual NIC? How to implement such network design with KVM/QEMU on the Debian host and Windows VM?

Due to networking restrictions on the hosting providers' side, I cannot use a public IP address inside a virtual machine (IP to MAC filters). Also: I don't want the VMs to be directly accessible from the Internet.


The standard 'private' networking stack provided with KVM (dnsmasq) allows you to do this, defaults to a private subnet of All of your VM traffic is NAT'ed out the host and appears to the outside as if it were your host's public IP address (just like a router). If using virt-manager, you can simply go to the host details and provision more private networks and then attach the new VM's network interface to the subnet you defined for it.

  • It's worth noting that this is referred to as the "default" network. It's not normally enabled out-of-the box. You can start it with virsh net-start default and make it auto-start with virsh net-autostart default. It's also possible to forward ports through this NAT to your destination host using iptables or similar. This NAT's guest machine will get a DHCP assigned address, and the hypervisor host will keep this persistent. You can obtain this assigned IP address via virsh domifaddr <vm_name>. – Spooler Apr 12 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.