Introduction
In this article, we will discuss a common issue encountered when setting up a network bridge (br0) on a hypervisor like KVM. The goal is to allow virtual machines (VMs) to access the internet while also enabling the host machine to access other computers on the network. However, in some cases, the host may not be able to reach other computers, despite the VMs having internet connectivity.
Prerequisites
Before diving into the solution, ensure the following:
- Your system is running a Linux distribution as the host machine and KVM as the hypervisor.
- The network interface on the host machine is named eth0.
- You have configured the network bridge (br0) as described in the KVM documentation.
Understanding the Problem
When configuring a network bridge, the bridge interface (br0) is assigned an IP address from the same subnet as other devices on the network. This allows VMs to communicate with the host and other computers. However, when the host cannot access other computers, it might be due to incorrect settings on the bridge interface.
Checking Bridge Interface Settings
First, check the bridge interface settings by running the following command:
sudo ip addr show br0
This command will display the IP address, netmask, and other relevant information about the bridge interface.
Checking Firewall Rules
Another common issue is incorrect firewall rules. Ensure that the firewall is configured to allow traffic between the host and other computers on the network. Run the following command to check the firewall status:
sudo systemctl status firewalld
If the firewall is enabled, use the following command to list the active rules:
sudo firewall-cmd --list-all
Configuring IP Forwarding
To enable the host machine to forward traffic between VMs and the external network, you need to enable IP forwarding. Edit the /etc/sysctl.conf file and add the following line:
net.ipv4.ip_forward = 1
Save and close the file. Then, apply the changes by running:
sudo sysctl -p
Checking Network Masquerade
If IP forwarding is enabled, but the host still cannot access other computers, check if the network masquerade is enabled. Run the following command:
sudo iptables --list --table nat
Look for a rule that matches:
SNAT 0.0.0.0:0.0.0.0 -> 192.168.1.1:100
Replace "192.168.1.1" with the IP address of the host machine. If the rule is missing, add it using:
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
In summary, when setting up a network bridge on a hypervisor like KVM, ensure that the bridge interface is correctly configured, firewall rules are set up, IP forwarding is enabled, and network masquerade is configured. By following these steps, you should be able to allow VMs to access the internet while also enabling the host machine to access other computers on the network.