Troubleshooting: No Internet on QEMU VM despite Connection Present

Internet access fails in QEMU VMs primarily due to NAT misconfiguration, incorrect TAP device permissions, or host firewall rules blocking forwarded traffic. This guide resolves connectivity issues for Ubuntu Server 24.04 guests by verifying network backend settings, ensuring proper user privileges for virtual interfaces, and validating routing tables.

Verifying the Network Backend Configuration

The most common cause of "no internet" errors is an incomplete or incorrect network argument passed to the qemu-system-x86_64 command. Unlike KVM with Libvirt, which handles networking abstraction automatically, raw QEMU requires explicit configuration of the network backend and the guest-side NIC model. You must ensure that the -netdev and -device flags are paired correctly. For a standard NAT setup, which allows the VM to share the host's IP address, use the following structure:

-netdev user,id=net0 -device virtio-net-pci,netdev=net0

The user mode netdev creates a built-in DHCP server inside QEMU, assigning an IP (typically 10.0.2.15) to the guest. If you see the interface coming up but no traffic passing, verify that the guest’s default gateway is set to 10.0.2.2. Many users mistakenly configure static IPs within the guest that do not align with the QEMU internal subnet, causing packets to be dropped immediately. If you require a more complex topology, such as bridging, note that bridging Wi-Fi adapters directly is often unsupported on Linux hosts due to driver limitations. In such cases, consider using a TAP device instead, as discussed in our guide on KVM/QEMU: Resolving Static IP Address Assignment Issues with TAP Devices. However, for simple internet access, the user-mode NAT is the most reliable method.

Checking User Permissions and TAP Devices

When moving beyond user-mode NAT to TAP devices, permission errors frequently block connectivity. The host kernel restricts creation and manipulation of network interfaces to privileged users. If your QEMU process runs as a standard user, it cannot attach to the TAP interface unless specific udev rules or group memberships are configured. Historically, tools like tunctl were used to manage these interfaces, but this command is deprecated. Modern systems should use ip tuntap to create and configure interfaces before launching QEMU. For example:

sudo ip tuntap add dev tap0 mode tap
sudo ip link set tap0 up

You must then pass this existing interface to QEMU using the tap netdev type:

-netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0

If the VM still lacks internet, check if the TAP device is listed in the host’s routing table. A missing route means the host does not know how to forward packets between the TAP interface and the physical network adapter. Ensure that IP forwarding is enabled on the host by checking /proc/sys/net/ipv4/ip_forward. It should contain the value 1. If it is 0, enable it temporarily with:

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

Without this kernel parameter, all routed traffic from the VM will be silently discarded at the network stack level.

Diagnosing Host Firewall Interference

Even with correct QEMU arguments and TAP configurations, host firewalls like ufw or iptables can intercept and drop packets. By default, many Linux distributions enable strict firewall policies that block incoming connections and may interfere with forwarded traffic. Check the status of your firewall using sudo ufw status. If active, it might be dropping packets destined for the VM’s IP range. For NAT setups, the host firewall usually allows this traffic because it appears as outgoing from the host perspective. However, for TAP or bridge setups, the traffic looks like direct inbound traffic, requiring explicit allow rules. If you suspect firewall interference, temporarily disable the firewall to test connectivity:

sudo ufw disable

If internet access returns immediately, re-enable the firewall and add specific rules allowing traffic on the TAP interface or the bridge port. Do not rely on broad open rules for production environments. Refer to Add Bridge Interface to Docker Image for QEMU VM Reachability for advanced bridging scenarios where firewall management becomes critical for external reachability. Another subtle issue involves IPv6. Some ISPs provide IPv6 addresses but fail to route them correctly through virtual interfaces. If your VM has an IPv6 address but cannot ping external IPv6 hosts, while IPv4 works, you may need to adjust IPv6 firewall rules. See Explicitly Dropping IPv6 Packets with ip6tables if you encounter asymmetric routing issues specific to IPv6 traffic.

Validating Guest DNS Resolution

Sometimes the network layer is functional, but the application layer fails due to DNS resolution errors. Inside the Ubuntu Server 24.04 guest, check the contents of /etc/resolv.conf. In QEMU user-mode NAT, this file is managed automatically by QEMU and points to the internal DNS proxy at 10.0.2.3. If you manually edited this file or if systemd-resolved is interfering, DNS queries may timeout. Test connectivity by pinging an IP address directly, such as ping 8.8.8.8. If the ping succeeds but ping google.com fails, the issue is strictly DNS-related. Restarting the systemd-resolved service or resetting the resolvconf configuration usually resolves this discrepancy.

Frequently Asked Questions

Why can my VM ping the host but not the internet?

This indicates a routing or NAT translation issue on the host side. Verify that net.ipv4.ip_forward is enabled in the kernel parameters. Additionally, check that the host’s iptables nat table has masquerading rules for the VM’s subnet if you are using a custom bridge or TAP setup rather than QEMU’s built-in user mode.

Is bridging Wi-Fi possible on Linux hosts?

Direct bridging of Wi-Fi interfaces is generally not supported due to the way wireless drivers handle MAC addresses and frame injection. Instead, use a TAP device to emulate a wired Ethernet connection, which provides stable connectivity without the constraints of wireless hardware limitations.

How do I fix DHCP failures in QEMU user mode?

Ensure that the guest OS is set to obtain an IP address automatically via DHCP. In Ubuntu Server, verify that netplan is configured to request an IP on the primary interface. If the VM hangs at "waiting for network," check that no static IP conflicts exist with the QEMU internal subnet (10.0.2.x).

What causes intermittent connectivity in TAP setups?

Intermittent drops often stem from MTU mismatches between the host, the TAP interface, and the guest. Ensure that the MTU on the TAP device matches the physical interface’s MTU, typically 1500 bytes. Also, verify that no firewall rules are fragmenting packets in a way that exceeds the path MTU.

Can I use both NAT and Bridged networking simultaneously?

Yes, you can attach multiple network devices to a single VM. Use -netdev user for internet access and -netdev tap for local LAN communication. Each device gets its own IP address and routing table entry within the guest, allowing simultaneous access to different network segments.