Gentoo/VM Tap Networking

Page last edited 1,240 days 9 hours ago
From Alon Bar-Lev's Site
Jump to: navigation, search

VM Tap Networking

Most of recent VMs support Linux native tap driver. A simple integration with OpenRC eases the use.

What you get is the following setup:

 Host(vbr0) <--+--> (vm0)VM0
    |         |
   NAT        +--> (vm1)VM1

The NAT is optional, if you like you can add eth0 to the bridge and have the VMs accessing the network directly.


Linux Kernel Configuration:
  [*] Networking support  ---> 
    Networking options  --->
      <M> 802.1d Ethernet Bridging
      [*]   IGMP/MLD snooping
  Device Drivers  ---> 
    [*] Network device support  --->
      <M>   Universal TUN/TAP device driver support
Linux Kernel Configuration: KVM
  Device Drivers  ---> 
    [*] Network device support  --->
      <M>   MAC-VLAN support (EXPERIMENTAL)
      <M>     MAC-VLAN based tap driver (EXPERIMENTAL)
  [*] Virtualization  --->
    <M>   Host kernel accelerator for virtio net (EXPERIMENTAL)
emerge net-misc/bridge-utils


File: /etc/conf.d/net
iproute2_vm0="group users"

iproute2_vm1="group users"

rc_net_vbr0_need="firewall net.vm0 net.vm1" # firewall is optional
bridge_vbr0="vm0 vm1"
brctl_vbr0="setfd 0
sethello 1
stp off"

To enable NAT to world, see Gentoo/Firewall_Using_Firehol:

emrege net-firewall/firehol
rc-update add firehol default
File: /etc/firehol/firehol.conf
interface "eth+ wlan+ ppp+" inet1
        policy  reject
        protection              strong  10/sec  10
        server  ident           reject  with tcp-reset

        client  all             accept

interface "vbr0" local1
        policy  reject
        protection              strong  10/sec  10
        server  ident           reject  with tcp-reset

        client  all             accept

router tun_nat  inface "eth+ wlan+ ppp+" outface "vbr0"
        route   ident           reject with tcp-reset
        server  ident           reject with tcp-reset
        masquerade              reverse

        client  all             accept
ln -s net.lo /etc/init.d/net.vm0
ln -s net.lo /etc/init.d/net.vm1
ln -s net.lo /etc/init.d/net.vbr0
/etc/init.d/net.vbr0 start

Also recommended to install dnsmasq and use host machine as DNS source pf VMs, so VM can always find correct DNS.

emerge net-dns/dnsmasq

If you are using VPN or dynamic interfacing, modify:

File: /etc/conf.d/dnsmasq
rc-update add dnsmasq default
/etc/init.d/dnsmasq start

qemu settings


 -net nic,netdev=eth0 -netdev tap,id=eth0,ifname=vm0,script=/bin/true

KVM Arguments:

 -net nic,netdev=eth0,model=virtio -netdev tap,id=eth0,ifname=vm0,script=/bin/true,vhost=on


Alon Bar-Lev


Originally written by: Alon Bar-Lev - 2011-11-17

Authors are people who have worked on this document and have made significant changes to its content. If you have edited this article and wish to add yourself to the authors list please read "Who are Authors".