Windows 10 guests on QEMU/KVM often fail to access websites due to misconfigured network bridges, incorrect NAT routing, or restrictive firewall rules blocking outbound traffic. This guide provides a systematic approach to diagnosing connectivity issues by verifying the host’s bridge configuration, checking DNS resolution within the guest, and ensuring that virtual network interfaces are correctly attached to a functional libvirt network definition.
Verifying Host Network Bridge Configuration
The foundation of any KVM virtual machine’s internet access is a properly configured network bridge on the host Linux system. If the physical interface is not bridged correctly, the VM cannot route packets to the external world. You should first check if the bridge device exists and includes the correct physical port. Use the
ip link show command to list all interfaces and identify your bridge, typically named
br0 or similar. Ensure that the physical Ethernet interface, such as
eth0 or
enp3s0, is listed as a member of this bridge.
If the bridge is missing or misconfigured, you may need to recreate it using Netplan or NetworkManager depending on your distribution. For systems using Netplan, verify the YAML configuration in
/etc/netplan/ to ensure the
dhcp4: true setting is applied to the bridge rather than the physical interface directly. After making changes, apply them with
sudo netplan apply. A common mistake is leaving the physical interface with its own IP address while also adding it to a bridge, which causes routing conflicts. The physical interface should generally have no IP address assigned when part of a bridge.
Checking Libvirt Network Definitions
QEMU/KVM relies on libvirt to manage virtual networks. By default, libvirt creates a NAT-based network called
default that handles DHCP and routing for VMs without explicit bridge configurations. To verify if this network is active, run
virsh net-list --all. Look for the
default network and check its state. It should be marked as
running. If it is inactive, start it with
virsh net-start default.
Sometimes, the
default network may be defined but disabled from autostart. To ensure it starts automatically with the host, enable it using
virsh net-autostart default. If you are using a custom bridge instead of the default NAT, ensure that the VM’s XML configuration references the correct network name. Inspect the VM’s definition with
virsh dumpxml [vm-name] and look for the
<interface> section. Verify that the
<source> tag points to the correct bridge or network interface. Mismatched names here are a frequent cause of "no internet" errors even when the host network is working perfectly.
Diagnosing DNS Resolution Issues
A common symptom of networking problems is the ability to ping an IP address (like
8.8.8.8) but failing to load websites by domain name. This indicates that basic IP connectivity is present, but DNS resolution is broken. Inside the Windows 10 guest, open Command Prompt and run
nslookup google.com. If this fails, check the DNS server settings in Windows Network Connections. Ensure that the adapter is set to obtain DNS automatically or manually specify reliable servers like
8.8.8.8 or
1.1.1.1.
If DNS works inside the guest but websites still do not load, the issue might be related to MTU (Maximum Transmission Unit) mismatches. Large packets being fragmented incorrectly can cause timeouts for certain web services. You can test this by pinging with a specific size limit using
ping -f -l 1472 8.8.8.8 from the guest. If this fails, reduce the packet size until it succeeds, indicating an MTU issue. Adjusting the MTU in the Windows network adapter properties or on the host bridge can resolve these silent failures.
Firewall and Security Software Interference
Both the host and guest firewalls can block outbound web traffic. On the Windows 10 guest, temporarily disable third-party antivirus software and Windows Defender Firewall to rule out local blocking. Check if the problem persists. If internet access returns, adjust the firewall rules to allow HTTP and HTTPS traffic for your browser application.
On the host side, iptables or nftables rules might inadvertently drop packets from the VM. Review the host’s firewall logs for dropped packets originating from the VM’s MAC address. If you are using UFW (Uncomplicated Firewall), ensure that forwarding is enabled for the bridge interface. Run
sudo ufw status verbose to check the policy. Additionally, some hosts use
firewalld; ensure that the zone associated with the bridge allows masquerading if you are using NAT. Masquerading translates the VM’s private IP to the host’s public IP, which is essential for internet access in NAT setups.
For more detailed insights into isolated network issues, see
Libvirt Guests on Isolated Network Cannot Ping Each Other. If you suspect the underlying connection setup is flawed, refer to
Troubleshooting: No Internet on QEMU VM despite Connection Present.
Frequently Asked Questions
Why can I ping IP addresses but not load websites?
This usually indicates a DNS resolution failure rather than a complete network outage. Check the DNS server settings in the Windows guest’s network adapter properties and try switching to public DNS servers like Google’s 8.8.8.8. Clearing the DNS cache in Windows with
ipconfig /flushdns can also help if stale records are causing issues.
How do I reset the libvirt default network?
If the default network is corrupted, destroy it with
virsh net-destroy default and then undefine it with
virsh net-undefine default. Restart the libvirt daemon using
sudo systemctl restart libvirtd, which will recreate the default network definition automatically. Start it again with
virsh net-start default to restore functionality.
What causes MTU mismatch errors in QEMU VMs?
MTU mismatches occur when the virtual network interface has a different maximum packet size than the physical network, leading to dropped packets that exceed the limit. This often happens when tunneling protocols are involved. Adjusting the MTU setting in the guest OS to match the effective path MTU, typically 1500 for standard Ethernet, resolves most connectivity glitches.
Can I use a static IP for my Windows 10 VM to fix internet issues?
Yes, assigning a static IP within the same subnet as the bridge can help isolate DHCP-related problems. However, you must manually configure the gateway and DNS settings to match your network’s infrastructure. Ensure that the static IP does not conflict with other devices on the network to avoid ARP confusion.
Why does my VM lose internet after host reboot?
This often happens if the libvirt network is not set to autostart or if the network bridge service starts before the physical interface is ready. Enable autostart for the libvirt network using
virsh net-autostart default and ensure your network manager has appropriate dependencies to bring up the bridge only after the physical link is established.