-3

I'm learning about KVM networking and I came up with this question: When I set a KVM domain to use a bridged network (no NAT), I see that KVM (or libvirt) creates a tap0 having virbr0 as master in my case. Now, I don't see any other interface participating in the bridge (brctl show). I'm using a wireless connection in my host while doing the experiment, and I have connection in the guest.

  • So how the host ends up providing connection to the guest?
  • As far as I understand, a bridge should connect one interface to another. So what sense makes a bridge with a single interface?
  • Besides, wireless interfaces are not supposed to be able to be included in a bridge right?

Well, I'm confused at this point. I would appreciate some enlightenment from the experts. Thank you!

Dimitrius J
  • 41
  • 4

1 Answers1

1

So how the host ends up providing connection to the guest?

For the default libvirt network on virbr0, libvirt creates NAT rules that masquerade outbound connections from hosts attached to that bridge. For example, on my system, we see:

# iptables -t nat -S
[...]
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[...]

As far as I understand, a bridge should connect one interface to another. So what sense makes a bridge with a single interface?

The bridge forms a virtual network for all the virtual machines you create that make use of that libvirt "network". If you boot a second virtual machine, you will see more than one interface on the bridge.

Besides, wireless interfaces are not supposed to be able to be included in a bridge right?

As you will see from the above, the outbound interface does not need to participate in the bridge. The connection between your virtual machines and the outside world is a routed (layer 3) connection, not a layer 2 connection.

why is the bridge needed? What is its role? Wouldn't it be enough then to have tap0?

The bridge creates a virtual layer 2 network for your virtual machines.

  • This allows your vms to talk to each other directly.
  • It allows broadcast traffic between virtual machines (and the host).
  • It allows policies (like firewall rules) to be applied to the virtual network, rather than to individual machines.
  • It permits libvirt to attach a DHCP server to the network to service DHCP requests from your virtual machines.
  • Etc.
larsks
  • 277,717
  • 41
  • 399
  • 399
  • Great, that makes it more clear. Now, one last clarification: How we go from tap0 at layer 2 to ip? I mean, is the bridge virbr0 itself who removes the eth header that comes from tap0 and sends the IP packet to its assigned IP? – Dimitrius J May 02 '18 at 16:08
  • 1
    I'm afraid I don't follow your question. `tap0` is (for the mostp part) just an ethernet interface like any other interface. Ethernet frames come into it from the attached vm and are processed by the kernel just like frames coming in a physical nic. – larsks May 02 '18 at 17:26