Gentoo/VM Tap Networking

Page last edited 1,325 days 8 hours ago
From Alon Bar-Lev's Site
Jump to: navigation, search

VM Tap Networking

Most of recent VMs support Linux native tap driver. A simple integration with OpenRC eases the use.

What you get is the following setup:

 Host(vbr0) <--+--> (vm0)VM0
    |         |
   NAT        +--> (vm1)VM1
    |
  (eth0)

The NAT is optional, if you like you can add eth0 to the bridge and have the VMs accessing the network directly.

Configuration

Linux Kernel Configuration:
  [*] Networking support  ---> 
    Networking options  --->
      <M> 802.1d Ethernet Bridging
      [*]   IGMP/MLD snooping
  Device Drivers  ---> 
    [*] Network device support  --->
      <M>   Universal TUN/TAP device driver support
Linux Kernel Configuration: KVM
  Device Drivers  ---> 
    [*] Network device support  --->
      <M>   MAC-VLAN support (EXPERIMENTAL)
      <M>     MAC-VLAN based tap driver (EXPERIMENTAL)
  [*] Virtualization  --->
    <M>   Host kernel accelerator for virtio net (EXPERIMENTAL)
emerge net-misc/bridge-utils

Add:

File: /etc/conf.d/net
tuntap_vm0="tap"
rc_net_vm0_need="firewall"
iproute2_vm0="group users"
config_vm0="null"

tuntap_vm1="tap"
rc_net_vm1_need="firewall"
iproute2_vm1="group users"
config_vm1="null"

rc_net_vbr0_provide="!net"
rc_net_vbr0_need="firewall net.vm0 net.vm1" # firewall is optional
bridge_vbr0="vm0 vm1"
config_vbr0="192.168.151.1/24"
brctl_vbr0="setfd 0
sethello 1
stp off"

To enable NAT to world, see Gentoo/Firewall_Using_Firehol:

emrege net-firewall/firehol
rc-update add firehol default
File: /etc/firehol/firehol.conf
interface "eth+ wlan+ ppp+" inet1
        policy  reject
        protection              strong  10/sec  10
        server  ident           reject  with tcp-reset

        client  all             accept

interface "vbr0" local1
        policy  reject
        protection              strong  10/sec  10
        server  ident           reject  with tcp-reset

        client  all             accept

router tun_nat  inface "eth+ wlan+ ppp+" outface "vbr0"
        route   ident           reject with tcp-reset
        server  ident           reject with tcp-reset
        masquerade              reverse

        client  all             accept
ln -s net.lo /etc/init.d/net.vm0
ln -s net.lo /etc/init.d/net.vm1
ln -s net.lo /etc/init.d/net.vbr0
/etc/init.d/net.vbr0 start

Also recommended to install dnsmasq and use host machine as DNS source pf VMs, so VM can always find correct DNS.

emerge net-dns/dnsmasq

If you are using VPN or dynamic interfacing, modify:

File: /etc/conf.d/dnsmasq
DNSMASQ_OPTS="--strict-order"
rc-update add dnsmasq default
/etc/init.d/dnsmasq start

qemu settings

Arguments:

 -net nic,netdev=eth0 -netdev tap,id=eth0,ifname=vm0,script=/bin/true

KVM Arguments:

 -net nic,netdev=eth0,model=virtio -netdev tap,id=eth0,ifname=vm0,script=/bin/true,vhost=on

Maintainer

Alon Bar-Lev

Authors

Originally written by: Alon Bar-Lev - 2011-11-17


Authors are people who have worked on this document and have made significant changes to its content. If you have edited this article and wish to add yourself to the authors list please read "Who are Authors".