What I try to achieve:

Multiple virtual machines (virtualbox) on a Debian host which communicate with another server (not with each other or the host). All VMs need to have the same static network settings (so that i can clone and use them without changing the settings in the guest). Every networking attempt of the VMs has to be redirected to the aforementioned server.

My current setup:

  1. I create a tap on the host for each VM and use bridged networking to connect the VMs with the corresponding tap
  2. All taps are connected with a bridge. The bridge has an ip address which is the gateway for the virtual machines.
  3. The host as a dedicated interface which connects it to the server. This interface is also connected with the bridge
  4. An iptables SNAT rule on this interface to connect the VMs with the server
  5. An iptables DNAT rule redirects all traffic from the bridge to the server

This works so far. But with this setup the VMs cannot have the same ip address because they are connected via the bridge. I tried to SNAT the ip addresses on the taps but that didn't work.

  • so that i can clone and use them without changing the settings in the guest → Have you considered DHCP? Sounds much saner. Remember you can use DHCP reservations to give each VM a static IP via DHCP with all the config being on the DHCP server(s). – derobert Mar 31 '15 at 14:02
  • @derobert: yes, I'm currently using DHCP as workaround. But I hope there is a solution with static settings. I start and clone the VMs from a saved state and that leads to problems if they still have a DHCP lease. – johnbaum Mar 31 '15 at 14:11

You could set up NAT with each guest on its on private network. First, you'd need to stop bridging all of their network interfaces together (after all, if they're all on the same switch, they're hardly on their own private networks).

Then you'd set up NAT rules, and maybe it'd work. But probably not—the outgoing path should work, but the return path is a problem. The NAT machinery gets a reply packet, NATs it back to the source (or whatever). Then it passes it to routing... which sends it where? All the guests have that same IP address, all their interfaces have the same address/subnet mask.

So we need to fix routing. Thankfully, that's doable, with policy routing.

If you add in -t mangle rules for each guest (based on the source port, e.g., the vnet0 or whatever) you could mark the connections. Then you can route the response back (using ip rule) based on that mark.

That's a lot of config, but once you get it working, it's scriptable. It'll probably work. I haven't tested it. Whether its sane or not, well… I'd try to get DHCP working right personally. Consider what the next person to have to administer that will think (which may well be you in a few months once you've forgotten exactly how it works.)

| improve this answer | |
  • First, you'd need to stop bridging all of their network interfaces together - but how can I connect them with the NIC of the host? – johnbaum Apr 1 '15 at 12:58
  • @johnbaum via routing / forwarding, like you'd do on a firewall. – derobert Apr 1 '15 at 13:50

Simple answer: no. What you're trying to do is, from a networking perspective, identical to trying to have multiple physical hosts with the same IP. It won't work.

| improve this answer | |
  • 1
    multiple physical hosts with the same IP - But that is possible if they are not physically connected. Isn't it possible to simulate the same in my setup? The VMs do not have to communicate with each other. – johnbaum Mar 31 '15 at 14:26
  • They have to communicate with an external host, so they will be able to communicate with each other. It won't work. – John Mar 31 '15 at 14:35
  • The host is in a different network. It is possible that you and me have the same (private) ip right now. Although we communicate with the same stackexchange server. – johnbaum Mar 31 '15 at 14:43
  • It. Will. Not. Work. You and I may have the same private IP, but we're not on the same virtual host (local network). – John Mar 31 '15 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.