KVM host // networking

requirements

that should be enabled already

sysctl net.ipv4.ip_forward

also assuming table filter chain forward NAT accept

nft list ruleset | less
# ==> table inet chain forward

–either– casual setup

virsh net-list --all

# debian - enabled manually
virsh net-start default
virsh net-autostart default

–or– diy nat & bridge

the other way around is to NAT yourself

virsh net-destroy default
virsh net-autostart default --disable
# no need to undefine

and setup a bridge as follows

debian/ubuntu (w/o netplan nor network-manager)

vi /etc/network/interfaces

auto kvmbr0
iface kvmbr0 inet static
        address 192.168.122.1/24
        bridge_ports none

–or– manually (see slackware setup right below)

slackware

vi /etc/rc.d/rc.inet1

brctl addbr kvmbr0
ifconfig kvmbr0 192.168.122.1/24 up
ip addr add xxxx::xxxx:1 dev kvmbr0

shared

and setup NAT

vi /etc/nftables.conf

table ip nat {
    chain postrouting {
        type nat hook postrouting priority srcnat;

        # kvm
        ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 oif eth0 masquerade;
        ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 oif wlan0 masquerade;
    }
}

ready to go

check

brctl show kvmbr0
ifconfig kvmbr0

# restart not reload - that includes a flush anyway
systemctl restart nftables

#iptables -t nat -nvL
nft list ruleset | less
# ==> table ip nat

and eventually point the kvm guests against it

# --network bridge=kvmbr0,model=virtio \

vi /data/guests/$guest/$guest.xml

    <interface type='bridge'>
      <source bridge='kvmbr0'/>
      <model type='virtio'/>
    </interface>

stub dns hotfix

cp -pi /etc/systemd/resolved.conf /etc/systemd/resolved.conf.dist
vi /etc/systemd/resolved.conf

DNSStubListenerExtra=192.168.122.1

systemctl restart systemd-resolved.service
netstat -lntup | grep -E ':53[[:space:]]'

resources

stub dns

https://unix.stackexchange.com/questions/445782/how-to-allow-systemd-resolved-to-listen-to-an-interface-other-than-loopback

https://www.freedesktop.org/software/systemd/man/resolved.conf.html#DNSStubListenerExtra=