I have a home network 192.168.1.0 behind a router 192.168.1.1. A set of existing Linux and Windows hosts are on this network, most on wired ethernet connections. I am configuring a new server that runs a KVM hypervisor and 3 Debian guests. The new server uses wifi for network connectivity.
On the hypervisor, I used
virsh to configure a virtual network like this:
<network> <name>virtual</name> <forward mode='route'/> <ip address='192.168.2.1' netmask='255.255.255.0'> <dhcp> <range start='192.168.2.2' end='192.168.2.255'/> <host mac='52:54:00:00:00:01' ip='192.168.2.2'/> <host mac='52:54:00:00:00:02' ip='192.168.2.3'/> <host mac='52:54:00:00:00:03' ip='192.168.2.4'/> </dhcp> </ip> </network>
Then, I created a static route in my router from 192.168.2.0/24 to the hypervisor's IP address of 192.168.1.41.
When I created the Debian guests, I specified the virtual network name and the MAC addresses from the
virsh virtual network, like this:
This results in
/etc/network/interfaces like this on each guest:
iface eth0 inet static address 192.168.2.2 netmask 255.255.255.0 network 192.168.2.0 broadcast 192.168.2.255 gateway 192.168.2.1
With this configuration in place, things mostly work. I can:
- Connect from hosts on 192.168.1.0 to both hypervisor IP addresses (.2.1 and .1.41)
- Connect from hosts on 192.168.1.0 to each guest
- Connect from the hypervisor to each guest
- Connect from each guest to the hypervisor (.2.1) and to each other guest
- Connect from each guest to the public internet
- Forward external (internet) connections from the router to individual guests
However, I cannot connect from the guests to any host on the 192.168.1.0 network. For instance, I can't ssh from 192.168.2.2 to 192.168.1.31.
traceroute shows something like this:
traceroute to 192.168.1.31 (192.168.1.31), 30 hops max, 60 byte packets 1 sol (192.168.2.1) 0.295 ms 0.252 ms 0.243 ms 2 * * * 3 * * * 4 * * * 5 * * * 6 * * *
I am not sure whether my configuration is incorrect, or whether I might be running into a problem with the wireless access point.
I've tried adding
ebtables configuration (as discussed here) to do MAC translation, but that did not make any difference. I've attempted to add a separate bridge network device outside of
virsh, but the existing virtual devices cannot be attached to any other bridges. I've considered other options like a
virsh filter or perhaps some iptables rules, but I'm grasping at straws.
Can someone suggest the right way to approach this?