ubuntu KVM guest with no network connection after configuring network bridge

Question

I am trying to add KVM guest (Ubuntu 18.04) to local network like other real servers in the network. I configured KVM bridge interface in the host system (Ubuntu 18.04) and it works fine with connection. Host system is reachable over the local network to other servers.

netplan config for the host system:

$ cat 01-netcfg.yaml
# This file describes the network interfaces available on your system
# For more information, see netplan(5).
network:
  version: 2
  renderer: networkd
  ethernets:
    eno1:
      dhcp4: false
  bridges:
    br0:
      interfaces: [eno1]
      addresses: [192.168.1.105/24]
      gateway4: 192.168.1.1
      nameservers:
        addresses: [x.x.x.x, x.x.x.x]
      dhcp4: false

ip a output showing bridge interface :

    10697: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 62:cb:37:3c:c0:70 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.105/24 brd 192.168.1.255 scope global br0
       valid_lft forever preferred_lft forever
    inet6 fe80::60cb:37ff:fe3c:c070/64 scope link 
       valid_lft forever preferred_lft forever

I created KVM network interface using the bridge br0

virsh net-edit br0 output:

<network>
  <name>br0</name>
  <uuid>d277e3d1-b34e-4b1f-ae69-6a3c8f75626c</uuid>
  <forward mode='bridge'/>
  <bridge name='br0'/>
</network>

developer@serv31:~$ virsh net-list
 Name                 State      Autostart     Persistent
----------------------------------------------------------
 br0                  active     yes           yes
 default              active     yes           yes

interface info of the KVM guest domain:

    <interface type='network'>
      <mac address='52:54:00:14:dc:af'/>
      <source network='br0'/>
      <model type='rtl8139'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
    </interface>

In the guest VM I configured netplan to give it a static IP. It did boot with the configured IP.

$ cat 50-cloud-init.yaml
network:
  version: 2
  ethernets:
    ens3:
      addresses: [192.168.1.50/24]
      gateway4: 192.168.1.1
      nameservers:
        addresses: [x.x.x.x, x.x.x.x]
      dhcp4: false

guest VM ip a output:

$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:14:dc:af brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.50/24 brd 192.168.1.255 scope global ens3
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fe14:dcaf/64 scope link 
       valid_lft forever preferred_lft forever

Guest VM is able to reach (ping, telnet) host system, Host system can reach guest VM. But no other server in the network can reach guest VM, and guest VM cannot access internet too. Please help me fixing this. Do let me know if you need more info.

EDIT :

ip link output :

:~$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br0 state UP mode DEFAULT group default qlen 1000
    link/ether 00:21:9b:9a:f2:be brd ff:ff:ff:ff:ff:ff
3: eno2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:21:9b:9a:f2:c0 brd ff:ff:ff:ff:ff:ff
4: eno3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:21:9b:9a:f2:c2 brd ff:ff:ff:ff:ff:ff
5: eno4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:21:9b:9a:f2:c4 brd ff:ff:ff:ff:ff:ff
6: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default 
    link/ether 02:42:b3:0f:d6:24 brd ff:ff:ff:ff:ff:ff
9: virbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 52:54:00:56:08:1e brd ff:ff:ff:ff:ff:ff
10: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel master virbr0 state DOWN mode DEFAULT group default qlen 1000
    link/ether 52:54:00:56:08:1e brd ff:ff:ff:ff:ff:ff
19219: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether fe:54:00:14:dc:af brd ff:ff:ff:ff:ff:ff
8744: vnet1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master virbr0 state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether fe:54:00:6f:20:0f brd ff:ff:ff:ff:ff:ff
10950: vnet2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master virbr0 state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether fe:54:00:c1:0e:86 brd ff:ff:ff:ff:ff:ff
10697: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 62:cb:37:3c:c0:70 brd ff:ff:ff:ff:ff:ff
10971: vnet3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether fe:54:00:a4:13:1c brd ff:ff:ff:ff:ff:ff

iptable rules containing virbr0 and br0

:~$ sudo iptables-save | grep br0
-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
-A POSTROUTING -o br0 -j MASQUERADE
-A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A FORWARD -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i br0 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i virbr0 -o br0 -j ACCEPT
-A OUTPUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT

Please add an `ip link` output on host *while* the VM is running: that's to double check a tap interface was set as bridge port on br0. Also, please try again without any firewall, including ufw or iptables. The reason why on Linux iptables can affect a bridge is documented [here](http://ebtables.netfilter.org/documentation/bridge-nf.html) and [there](http://ebtables.netfilter.org/br_fw_ia/br_fw_ia.html#section7). — A.B, May 19 '20 at 11:21

score 0 · Answer 1 · answered May 20 '20 at 10:27

sudo iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
sudo iptables -A FORWARD -i br0 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i virbr0 -o br0 -j ACCEPT
sudo iptables -I FORWARD 1 -i br0 -o br0 -j ACCEPT

above rules fixed the problem.

ubuntu KVM guest with no network connection after configuring network bridge

1 Answers1