Managing Networks | Virtualization Guide

openSUSE Leap Documentation › Virtualization Guide › Managing Virtual Machines with libvirt › Managing Networks

Virtualization Guide

Navigation←→

Applies to openSUSE Leap 42.3

12 Managing Networks

Abstract#

This chapter introduces common networking configurations supported by libvirt. It does not depend on the hypervisor used. It is valid for all hypervisors supported by libvirt, such as KVM or Xen. These setups can be achieved using both the graphical interface of Virtual Machine Manager and the command line tool virsh.

12.1 Virtual Networks
12.2 Bridged Networking

There are two common network setups to provide a VM Guest with a network connection:

A virtual network for the guest
A network bridge over a host's physical network interface that the guest can use

12.1 Virtual Networks #

A virtual network is a computer network which does not consist of a physical network link, but rather uses a virtual network link. Each host can have several virtual networks defined. Virtual networks are based on virtual devices that connect virtual machines inside a hypervisor. They allow outgoing traffic translated to the LAN and are provided with DHCP and DNS services. Virtual networks can be either isolated, or forwarded to a physical network.

Guests inside an isolated virtual network can communicate with each other, but cannot communicate with guests outside the virtual network. Also, guests not belonging to the isolated virtual network cannot communicate with guests inside.

On the other hand, guests inside a forwarded (NAT, network address translation) virtual network can make any outgoing network connection they request. Incoming connections are allowed from VM Host Server, and from other guests connected to the same virtual network. All other incoming connections are blocked by iptables rules.

A standard libvirt installation on openSUSE Leap already comes with a predefined virtual network providing DHCP server and network address translation (NAT) named "default".

12.1.1 Managing Virtual Networks with Virtual Machine Manager #

You can define, configure, and operate both isolated and forwarded virtual networks with Virtual Machine Manager.

12.1.1.1 Defining Virtual Networks #

Start Virtual Machine Manager. In the list of available connections, right-click the name of the connection for which you need to configure the virtual network, and then select Details.
In the Connection Details window, click the Virtual Networks tab. You can see the list of all virtual networks available for the current connection. On the right, there are details of the selected virtual network.
Figure 12.1: Connection Details #
To add a new virtual network, click Add.
Specify a name for the new virtual network and click Forward.
Figure 12.2: Create virtual network #
To specify an IPv4 network address space definition, activate the relevant option and type it into the Network text entry.
Figure 12.3: Create virtual network #
libvirt can provide your virtual network with a DHCP server. If you need it, activate Enable DHCPv4, then type the start and end IP address range of assignable addresses.
To enable static routing for the new virtual network, activate the relevant option and type the network and gateway addresses.
Click Forward to proceed.
To specify IPv6-related options—network address space, DHCPv6 server, or static route—activate Enable IPv6 network address space definition and activate the relevant options and fill in the relevant boxes.
Click Forward to proceed.
Select whether you want isolated or forwarded virtual network.
Figure 12.4: Create virtual network #
For forwarded networks, specify the network interface to which the requests will be forwarded, and one of the forwarding modes: While NAT (network address translation) remaps the virtual network address space and allows sharing a single IP address, Routed connects the virtual switch to the physical host LAN with no network translation.
If you did not specify IPv6 network address space definition earlier, you can enable IPv6 internal routing between virtual machines.
(Optional) Optionally, change the DNS domain name.
Click Finish to create the new virtual network. On the VM Host Server, a new virtual network bridge virbrX is available, which corresponds to the newly created virtual network. You can check with brctl show. libvirt automatically adds iptables rules to allow traffic to/from guests attached to the new virbrX device.

12.1.1.2 Starting Virtual Networks #

To start a virtual network that is temporarily stopped, follow these steps:

Start Virtual Machine Manager. In the list of available connections, right-click the name of the connection for which you need to configure the virtual network, and then select Details.
In the Connection Details window, click the Virtual Networks tab. You can see the list of all virtual networks available for the current connection.
To start the virtual network, click Start.

12.1.1.3 Stopping Virtual Networks #

To stop an active virtual network, follow these steps:

Start Virtual Machine Manager. In the list of available connections, right-click the name of the connection for which you need to configure the virtual network, and then select Details.
In the Connection Details window, click the Virtual Networks tab. You can see the list of all virtual networks available for the current connection.
Select the virtual network to be stopped, then click Stop.

12.1.1.4 Deleting Virtual Networks #

To delete a virtual network from VM Host Server, follow these steps:

Start Virtual Machine Manager. In the list of available connections, right-click the name of the connection for which you need to configure the virtual network, and then select Details.
In the Connection Details window, click the Virtual Networks tab. You can see the list of all virtual networks available for the current connection.
Select the virtual network to be deleted, then click Delete.

12.1.1.5 Obtaining IP Addresses with `nsswitch` for NAT Networks (in KVM) #

On VM Host Server, install libvirt-nss, which provides NSS support for libvirt:
```
zypper in libvirt-nss
```

Add libvirt to /etc/nsswitch.conf:

...
hosts:  files libvirt mdns_minimal [NOTFOUND=return] dns
...

If NSCD is running, restart it:
```
systemctl restart nscd
```

Now you can reach the guest system by name from the host.

The NSS module has limited functionality. It reads /var/lib/libvirt/dnsmasq/*.status files to find the host name and corresponding IP addresses in a JSON record describing each lease provided by dnsmasq. Host name translation can only be done on those VM Host Servers using a libvirt-managed bridged network backed by dnsmasq.

For more information, see http://wiki.libvirt.org/page/NSS_module.

12.1.2 Managing Virtual Networks with `virsh` #

You can manage libvirt-provided virtual networks with the virsh command line tool. To view all network related virsh commands, run

# virsh help network
Networking (help keyword 'network'):
 net-autostart                  autostart a network
        net-create                     create a network from an XML file
        net-define                     define (but don't start) a network from an XML file
        net-destroy                    destroy (stop) a network
        net-dumpxml                    network information in XML
        net-edit                       edit XML configuration for a network
        net-event                      Network Events
        net-info                       network information
        net-list                       list networks
        net-name                       convert a network UUID to network name
        net-start                      start a (previously defined) inactive network
        net-undefine                   undefine an inactive network
        net-update                     update parts of an existing network's configuration
 net-uuid                       convert a network name to network UUID

To view brief help information for a specific virsh command, run virsh help VIRSH_COMMAND:

# virsh help net-create
  NAME
    net-create - create a network from an XML file

  SYNOPSIS
    net-create <file>

  DESCRIPTION
    Create a network.

  OPTIONS
    [--file] <string>  file containing an XML network description

12.1.2.1 Creating a Network #

To create a new running virtual network, run

root # virsh net-create VNET_DEFINITION.xml

The VNET_DEFINITION.xml XML file includes the definition of the virtual network that libvirt accepts.

To define a new virtual network without activating it, run

root # virsh net-define VNET_DEFINITION.xml

The following examples illustrate definitions of different types of virtual networks.

Example 12.1: NAT Based Network #

The following configuration allows VM Guests outgoing connectivity if it is available on VM Host Server. In the absence of VM Host Server networking, it allows guests to talk directly to each other.

<network>
<name>vnet_nated</name>1
<bridge name="virbr1" />2
 <forward mode="nat"/>3
 <ip address="192.168.122.1" netmask="255.255.255.0">4
  <dhcp>
   <range start="192.168.122.2" end="192.168.122.254" />5
   <host mac="52:54:00:c7:92:da" name="host1.testing.com" \
    ip="192.168.1.23.101" />6
   <host mac="52:54:00:c7:92:db" name="host2.testing.com" \
    ip="192.168.1.23.102" />
   <host mac="52:54:00:c7:92:dc" name="host3.testing.com" \
    ip="192.168.1.23.103" />
  </dhcp>
 </ip>
</network>

1	The name of the new virtual network.
2	The name of the bridge device used to construct the virtual network. When defining a new network with a <forward> mode of "nat" or "route" (or an isolated network with no <forward> element), `libvirt` will automatically generate a unique name for the bridge device if none is given.
3	Inclusion of the <forward> element indicates that the virtual network will be connected to the physical LAN. The `mode` attribute specifies the forwarding method. The most common modes are "nat" (default, network address translation), "route" (direct forwarding to the physical network, no address translation), and "bridge" (network bridge configured outside of `libvirt`). If the <forward> element is not specified, the virtual network will be isolated from other networks. For a complete list of forwarding modes, see http://libvirt.org/formatnetwork.html#elementsConnect.
4	The IP address and netmask for the network bridge.
5	Enable DHCP server for the virtual network, offering IP addresses ranging from the specified `start` and `end` attribute.
6	The optional <host> elements specify hosts that will be given names and predefined IP addresses by the built-in DHCP server. Any IPv4 host element must specify the MAC address of the host to be assigned a given name, the IP to be assigned to that host, and the name to be given to that host by the DHCP server. An IPv6 host element differs slightly from that for IPv4: there is no `mac` attribute since a MAC address has no defined meaning in IPv6. Instead, the `name` attribute is used to identify the host to be assigned the IPv6 address. For DHCPv6, the `name` is the plain name of the client host sent by the client to the server. Note that this method of assigning a specific IP address can also be used instead of the `mac` attribute for IPv4.

Example 12.2: Routed Network #

The following configuration routes traffic from the virtual network to the LAN without applying any NAT. The IP address range must be preconfigured in the routing tables of the router on the VM Host Server network.

<network>
 <name>vnet_routed</name>
 <bridge name="virbr1" />
 <forward mode="route" dev="eth1"/>1
 <ip address="192.168.122.1" netmask="255.255.255.0">
  <dhcp>
   <range start="192.168.122.2" end="192.168.122.254" />
  </dhcp>
 </ip>
</network>

1	The guest traffic may only go out via the `eth1` network device on the VM Host Server.

Example 12.3: Isolated Network #

This configuration provides a completely isolated private network. The guests can talk to each other, and to VM Host Server, but cannot reach any other machines on the LAN, as the <forward> element is missing in the XML description.

<network>
 <name>vnet_isolated</name>
 <bridge name="virbr3" />
 <ip address="192.168.152.1" netmask="255.255.255.0">
  <dhcp>
   <range start="192.168.152.2" end="192.168.152.254" />
  </dhcp>
 </ip>
 </network>

Example 12.4: Using an Existing Bridge on VM Host Server #

This configuration shows how to use an existing VM Host Server's network bridge br0. VM Guests are directly connected to the physical network. Their IP addresses will all be on the subnet of the physical network, and there will be no restrictions on incoming or outgoing connections.

<network>
        <name>host-bridge</name>
        <forward mode="bridge"/>
        <bridge name="br0"/>
</network>

12.1.2.2 Listing Networks #

To list all virtual networks available to libvirt, run:

root # virsh net-list --all

 Name                 State      Autostart     Persistent
----------------------------------------------------------
 crowbar              active     yes           yes
 vnet_nated           active     yes           yes
 vnet_routed          active     yes           yes
 vnet_isolated        inactive   yes           yes

To list available domains, run:

root # virsh list
 Id    Name                           State
----------------------------------------------------
 1     nated_sles12sp1                running
 ...

To get a list of interfaces of a running domain, run domifaddr DOMAIN, or optionally specify the interface to limit the output to this interface. By default, it additionally outputs their IP and MAC addresses:

root # virsh domifaddr nated_sles12sp1 --interface vnet0 --source lease
 Name       MAC address          Protocol     Address
-------------------------------------------------------------------------------
 vnet0      52:54:00:9e:0d:2b    ipv6         fd00:dead:beef:55::140/64
 -          -                    ipv4         192.168.100.168/24

To print brief information of all virtual interfaces associated with the specified domain, run:

root # virsh domiflist nated_sles12sp1
Interface  Type       Source       Model       MAC
---------------------------------------------------------
vnet0      network    vnet_nated   virtio      52:54:00:9e:0d:2b

12.1.2.3 Getting Details about a Network #

To get detailed information about a network, run:

root # virsh net-info vnet_routed
Name:           vnet_routed
UUID:           756b48ff-d0c6-4c0a-804c-86c4c832a498
Active:         yes
Persistent:     yes
Autostart:      yes
Bridge:         virbr5

12.1.2.4 Starting a Network #

To start an inactive network that was already defined, find its name (or unique identifier, UUID) with:

root # virsh net-list --inactive
 Name                 State      Autostart     Persistent
----------------------------------------------------------
 vnet_isolated        inactive   yes           yes

Then run:

root # virsh net-start vnet_isolated
Network vnet_isolated started

12.1.2.5 Stopping a Network #

To stop an active network, find its name (or unique identifier, UUID) with:

root # virsh net-list --inactive
 Name                 State      Autostart     Persistent
----------------------------------------------------------
 vnet_isolated        active     yes           yes

Then run:

root # virsh net-destroy vnet_isolated
Network vnet_isolated destroyed

12.1.2.6 Removing a Network #

To remove the definition of an inactive network from VM Host Server permanently, run:

root # virsh net-undefine vnet_isolated
Network vnet_isolated has been undefined

12.2 Bridged Networking #

A network bridge is used to connect two or more network segments. It behaves like a virtual network switch, and guest machines treat it transparently as a physical network interface. Any physical or virtual device can be connected to the bridge.

If there is a network bridge present on VM Host Server, you can connect a VM Guest to it directly. This provides the VM Guest with full incoming and outgoing network access.

12.2.1 Managing Network Bridges with YaST #

This section includes procedures to add or remove network bridges with YaST.

12.2.1.1 Adding a Network Bridge #

To add a network bridge on VM Host Server, follow these steps:

Start YaST › System › Network Settings.
Activate the Overview tab and click Add.
Select Bridge from the Device Type list and enter the bridge device interface name in the Configuration Name entry. Proceed with Next.
In the Address tab, specify networking details such as DHCP/static IP address, subnet mask or host name.
Using Dynamic Address is only useful when also assigning a device to a bridge that is connected to some DHCP server.
If you intend to create a virtual bridge that has no connection to a real Ethernet device, use Statically assigned IP Address. In this case, it is a good idea to use addresses from the private IP address ranges, for example, 192.168.x.x or 10.x.x.x.
To create a bridge that should only serve as a connection between the different guests without connection to the host system, set the IP address to 0.0.0.0 and the subnet mask to 255.255.255.255. The network scripts handle this special address as an unset IP address.
Activate the Bridged Devices tab and activate the network devices you want to include in the network bridge.
Click Next to return to the Overview tab and confirm with OK. The new network bridge should be active on VM Host Server now.

12.2.1.2 Deleting a Network Bridge #

To delete an existing network bridge, follow these steps:

Start YaST › System › Network Settings.
Select the bridge device you want to delete from the list in the Overview tab.
Delete the bridge with Delete and confirm with OK.

12.2.2 Managing Network Bridges with `brctl` #

This section includes procedures to add or remove network bridges with the brctl command line tool.

12.2.2.1 Adding a Network Bridge #

To add a new network bridge device on VM Host Server with brctl, follow these steps:

Log in as root on the VM Host Server where you want to create a new network bridge.
Choose a name for the new bridge—VIRBR_TEST in our example— and run
```
root # brctl addbr VIRBR_TEST
```

Check if the bridge was created on VM Host Server:

root # brctl show
bridge name     bridge id           STP enabled     interfaces
br0             8000.e06995ec09e8   no              eth0
virbr0          8000.525400b37ec9   yes             virbr0-nic
virbr_test      8000.000000000000   no

virbr_test is present, but is not associated with any physical network interface.

Add a network interface to the bridge:
```
root # brctl addif eth1
```
Important: Network Interface Must Be Unused
You can only enslave a network interface that is not yet used by other network bridge.
Optionally, enable STP (see Spanning Tree Protocol):
```
root # brctl stp VIRBR_TEST on
```

12.2.2.2 Deleting a Network Bridge #

To delete an existing network bridge device on VM Host Server with brctl, follow these steps:

List existing network bridges to identify the name of the bridge to remove:

root # brctl show
bridge name     bridge id           STP enabled     interfaces
br0             8000.e06995ec09e8   no              eth0
virbr0          8000.525400b37ec9   yes             virbr0-nic
virbr_test      8000.000000000000   yes             eth1

Delete the bridge:
```
root # brctl delbr VIRBR_TEST
```

12.2.3 Using VLAN Interfaces #

Sometimes, it is necessary to create a private connection either between two VM Host Servers or between VM Guest systems. For example, to migrate VM Guest to hosts in a different network segment, or to create a private bridge that only VM Guest systems may connect to, even when running on different VM Host Server systems. An easy way to build such connections is to set up VLAN networks.

VLAN interfaces are commonly set up on the VM Host Server and either interconnect the different VM Host Server systems, or they may be set up as a physical interface to an otherwise virtual-only bridge. It is even possible to create a bridge with a VLAN as a physical interface that has no IP address in the VM Host Server. That way, the guest systems have no possibility to access the host over this network.

Run the YaST module System › Network Settings. Follow this procedure to set up the VLAN device:

Procedure 12.1: Setting up VLAN Interfaces with YaST #

Press Add to create a new network interface.
In the Hardware Dialog, select Device Type VLAN.
Change the value of Configuration Name to the ID of your VLAN. Note that VLAN ID 1 is commonly used for management purposes.
Press Next.
Select the interface that the VLAN device should connect to below Real Interface for VLAN. If the desired interface does not appear in the list, first set up this interface without an IP Address.
Select the desired method for assigning an IP address to the VLAN device.
Press Next to finish the configuration.

It is also possible to use the VLAN interface as a physical interface of a bridge. This makes it possible to connect several VM Host Server-only networks and allows to live-migrate VM Guest systems that are connected to such a network.

YaST does not always allow to set no IP address. However, this may be a desired feature especially if VM Host Server-only networks should be connected. In this case, use the special address 0.0.0.0 with netmask 255.255.255.255. The system scripts handle this address as no IP address set.

Print this page

Virtualization Guide

12 Managing Networks

Abstract#

12.1 Virtual Networks #

12.1.1 Managing Virtual Networks with Virtual Machine Manager #

12.1.1.1 Defining Virtual Networks #

Figure 12.1: Connection Details #

Figure 12.2: Create virtual network #

Figure 12.3: Create virtual network #

Figure 12.4: Create virtual network #

12.1.1.2 Starting Virtual Networks #

12.1.1.3 Stopping Virtual Networks #

12.1.1.4 Deleting Virtual Networks #

12.1.1.5 Obtaining IP Addresses with nsswitch for NAT Networks (in KVM) #

12.1.2 Managing Virtual Networks with virsh #

12.1.2.1 Creating a Network #

Example 12.1: NAT Based Network #

Example 12.2: Routed Network #

Example 12.3: Isolated Network #

Example 12.4: Using an Existing Bridge on VM Host Server #

12.1.2.2 Listing Networks #

12.1.2.3 Getting Details about a Network #

12.1.2.4 Starting a Network #

12.1.2.5 Stopping a Network #

12.1.2.6 Removing a Network #

12.2 Bridged Networking #

12.2.1 Managing Network Bridges with YaST #

12.2.1.1 Adding a Network Bridge #

12.2.1.2 Deleting a Network Bridge #

12.2.2 Managing Network Bridges with brctl #

12.2.2.1 Adding a Network Bridge #

Important: Network Interface Must Be Unused

12.2.2.2 Deleting a Network Bridge #

12.2.3 Using VLAN Interfaces #

Procedure 12.1: Setting up VLAN Interfaces with YaST #

12.1.1.5 Obtaining IP Addresses with `nsswitch` for NAT Networks (in KVM) #

12.1.2 Managing Virtual Networks with `virsh` #

12.2.2 Managing Network Bridges with `brctl` #