Configuring Network for QEMU-KVM

NAT forwarding

    flowchart TD
    Internet[🌐 Internet / Physical Network<br/>Router: 192.168.1.1]

    subgraph HostMachine[KVM Host Machine]
        PhysicalNIC["🔌 Physical NIC (eth0)<br/>IP: 192.168.1.100"]

        subgraph VirtualNetwork[Libvirt Default NAT Network]
            Bridge["🔀 Virtual Bridge (virbr0)<br/>Gateway: 192.168.122.1/24<br/>DHCP + DNS + NAT"]
            DHCPServer["📡 dnsmasq Process<br/>DHCP Range: 192.168.122.2-254"]
            DummyInterface["📎 Dummy Interface (virbr0-nic)<br/>Provides stable MAC address"]

            Bridge <-.-> DummyInterface
            Bridge <--> DHCPServer
        end

        VM1_Tap["🔧 Virtual NIC (vnet0)<br/>VM #1: 192.168.122.100"]
        VM2_Tap["🔧 Virtual NIC (vnet1)<br/>VM #2: 192.168.122.101"]

        Bridge <--> VM1_Tap
        Bridge <--> VM2_Tap
    end

    Internet <-.-> PhysicalNIC
    PhysicalNIC <-.-> Bridge

    %% Styling
    classDef internet fill:#fbe9e7,stroke:#bf360c,stroke-width:2px,color:#000;
    classDef host fill:#f5f5f5,stroke:#9e9e9e,stroke-width:2px,color:#000;
    classDef physical fill:#e3f2fd,stroke:#1565c0,stroke-width:2px,color:#000;
    classDef bridge fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#000;
    classDef dhcp fill:#fff3e0,stroke:#ef6c00,stroke-width:2px,color:#000;
    classDef dummy fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px,color:#000;
    classDef vm fill:#bbdefb,stroke:#1976d2,stroke-width:2px,color:#000;

    class Internet internet;
    class HostMachine host;
    class PhysicalNIC physical;
    class Bridge bridge;
    class DHCPServer dhcp;
    class DummyInterface dummy;
    class VM1_Tap,VM2_Tap vm;

Remove default NAT network.

~]# virsh net-destroy default
~]# virsh net-autostart default --disable
~]# virsh net-undefine default
~]# systemctl restart libvirtd.service

Add default NAT network.

~]# virsh net-define /usr/share/libvirt/networks/default.xml
~]# virsh net-autostart default
~]# virsh net-start default

Check the default NAT network.

~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:50:56:a9:01:bc brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.100/24 brd 192.168.1.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::98ac:9a69:bc8d:446d/64 scope link noprefixroute
       valid_lft forever preferred_lft forever
3: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:54:00:cd:0a:cd brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
4: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr0 state DOWN group default qlen 1000
    link/ether 52:54:00:cd:0a:cd brd ff:ff:ff:ff:ff:ff

~]# brctl show
bridge name     bridge id               STP enabled     interfaces
virbr0          8000.525400cd0acd       yes             virbr0-nic

~]# virsh net-list
 Name                 State      Autostart     Persistent
----------------------------------------------------------
 default              active     no            no

virbr0 is a virtual network bridge. Think of it as a virtual Ethernet switch that all your VMs are plugged into.
virbr0-nic is a persistent "dummy" Ethernet network interface that is created as a placeholder for the bridge's MAC address.

Libvirt will add iptables rules to allow traffic to/from guests attached to the virbr0 device in the INPUT, FORWARD, OUTPUT and POSTROUTING chains. It will also attempt to enable ip_forward.

~]# iptables -t nat -L -n -v
~]# cat /proc/sys/net/ipv4/ip_forward

Reference:

・ What is the interface virbr0 for and how do I disable it?
・ libvirt Networking

Bridged networking

    flowchart TD
    subgraph YourPhysicalNetwork [Physical Network]
        Internet[🌐 Internet Router<br/>192.168.1.1]
        OtherDevice[💻 Other Device<br/>e.g., Laptop: 192.168.1.45]
    end

    subgraph HostMachine [KVM Host Machine]
        HostPhysicalEth0["🔧 Physical NIC (eth0)<br/>No IP - Slave to br0"]

        subgraph VirtualNetwork [Network Bridge]
            Br0["🌉 Bridge Interface (br0)<br/>IP: 192.168.1.100"]
            VM1["🖥️ VM #1 (vnet0)<br/>DHCP: 192.168.1.101"]
            VM2["🖥️ VM #2 (vnet1)<br/>DHCP: 192.168.1.102"]
        end

        Br0 <-..-> HostPhysicalEth0
        Br0 <---> VM1
        Br0 <---> VM2
    end

    Internet <-..-> Br0
    OtherDevice <-..-> Br0

    classDef bridgeNode fill:#fff3e0,stroke:#ef6c00,stroke-width:2px,color:#000;
    classDef vmNode fill:#ffcc80,stroke:#ef6c00,stroke-width:2px,color:#000;
    classDef internetNode fill:#fbe9e7,stroke:#bf360c,stroke-width:2px,color:#000;
    classDef deviceNode fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#000;

    class Br0 bridgeNode;
    class VM1,VM2 vmNode;
    class Internet internetNode;
    class OtherDevice deviceNode;

Using ifcfg file

~]# cat >/etc/sysconfig/network-scripts/ifcfg-eth0 <<EOF
DEVICE=eth0
ONBOOT=yes
BRIDGE=br0
NM_CONTROLLED=no
USERCTL=no
EOF

~]# cat >/etc/sysconfig/network-scripts/ifcfg-br0 <<EOF
DEVICE=br0
TYPE=Bridge
ONBOOT=yes
BOOTPROTO=static
IPADDR=192.168.1.100
NETMASK=255.255.255.0
GATEWAY=192.168.1.1
DNS1=8.8.8.8
NM_CONTROLLED=no
USERCTL=no
EOF

Using nmcli

+-----+   +---------+                           +---------------+
| em1 |---|         |          +------------+   |  Network one  |
+-----+   |         |----------|  br-bond0  |---| (native VLAN) |
          |  bond0  |          +------------+   +---------------+
+-----+   |         |
| em2 |---|         |
+-----+   +---------+                           +---------------+
               | +---------+   +------------+   |  Network two  |
               +-| vlan123 |---| br-vlan123 |---| (tagged VLAN) |
                 +---------+   +------------+   +---------------+

Bridging on a bond.

# Create the bridge <br0>.
nmcli con add type bridge con-name br0 ifname br0 bridge.stp off
nmcli con modify br0 ipv4.addresses '192.0.2.1/24' ipv4.gateway '192.0.2.254' ipv4.dns '8.8.8.8' ipv4.method manual

# Create the bond <bond0>.
nmcli con add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup,miimon=100" ipv4.method disabled ipv6.method ignore
nmcli con add type ethernet con-name bond0-em1 ifname em1 master bond0 slave-type bond
nmcli con add type ethernet con-name bond0-em2 ifname em2 master bond0 slave-type bond

# Attach <bond0> to the bridge <br0>.
nmcli con modify bond0 master br0 slave-type bridge

# Create the VLAN <123> on the bond <bond0> and attach to bridge <br0>.
nmcli con add type vlan con-name bond0.123 ifname bond0.123 dev bond0 id 123 master br0 slave-type bridge

# Activate
nmcli con up bond0
nmcli con up br0

Check.

ls /sys/class/net/br0/brif/
cat /proc/net/bonding/bond0

Using virsh

virsh iface-bridge eth0 br0
virsh iface-unbridge br0