Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There's a new server that is assigned 5 IP addresses. I want to use Xen to run several VMs with various services.

This is my first attempt to install Xen, I use this tutorial as a guideline. Stuck in the very beginning: they talk about replacing a single ip on an eth0 with a bridge br0. My server has 5: eth1 and 4 aliases eth1:1 .. eth1:4.

How should the network config look like?

  1. bridge that replaces eth1 completely, and then 4 aliases added to the bridge?
  2. bridge can only replace a single IP out of the 5?

Pardon my lame questions, first time in this forest.

share|improve this question
Bridge doesn't replace IPs at all, it rather substitutes primary network interface. Since aliases aren't interfaces, but are just additional IP-addresses, you possibly can now answer your own question. ;) – poige Oct 14 '12 at 17:04
up vote 2 down vote accepted

1 advice with xen, if you decide to use classic bridge (vs ovs), set it manually as the scripts didn't get it right for me at first (with the single nic being locked out)

something like this should get bridging to work:

auto lo br0
iface lo inet loopback

iface br0 inet static
        bridge_ports eth1
        bridge_stp off
        bridge_fd 0
        #bridge_hello 2
        #bridge_maxage 12

iface eth1 inet manual

Now on every guest os you will get an 'eth0' interface (rfr. bridge_fd=0), if you assign a ip address to that interface, it will be on the br0 bridge and will be able to do everything like the host can, given the fact that nothing is blocking it (netfilter etc)

for completeness sake, then you edit /etc/sysctl.conf (assuming debian here,sry) and set this as it might be needed for your network

net.ipv4.conf.eth1.proxy_arp = 1
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

and do sysctl -p to commit them. This disables netfilter from intervening on the bridge. Alternatively you could use iptables to do this too. from top of my head, something like this (they might not all be needed), but since I don't use these, it's just to give an idea:

iptables -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
iptables -I FORWARD -m physdev --physdev-in vif1.0 -j ACCEPT

That vif1.0 (or perhaps named a bit different) interface will be shown once your guest os is started, you can check the network on the host with the classic tools (ip, ifconfig etc).

share|improve this answer

You need to: Get rid of the aliases eth1:1 through eth1:4, set up the bridge on your existing `eth1 interface, and then go on with life.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.