I have a home network behind a router A set of existing Linux and Windows hosts are on this network, most on wired ethernet connections. I am configuring a new server that runs a KVM hypervisor and 3 Debian guests. The new server uses wifi for network connectivity.

On the hypervisor, I used virsh to configure a virtual network like this:

  <forward mode='route'/>
  <ip address='' netmask=''>
      <range start='' end=''/>
      <host mac='52:54:00:00:00:01' ip=''/>
      <host mac='52:54:00:00:00:02' ip=''/>
      <host mac='52:54:00:00:00:03' ip=''/>

Then, I created a static route in my router from to the hypervisor's IP address of

When I created the Debian guests, I specified the virtual network name and the MAC addresses from the virsh virtual network, like this:

--network network=virtual,mac=52:54:00:00:00:01

This results in /etc/network/interfaces like this on each guest:

iface eth0 inet static

With this configuration in place, things mostly work. I can:

  • Connect from hosts on to both hypervisor IP addresses (.2.1 and .1.41)
  • Connect from hosts on to each guest
  • Connect from the hypervisor to each guest
  • Connect from each guest to the hypervisor (.2.1) and to each other guest
  • Connect from each guest to the public internet
  • Forward external (internet) connections from the router to individual guests

However, I cannot connect from the guests to any host on the network. For instance, I can't ssh from to

A traceroute shows something like this:

traceroute to (, 30 hops max, 60 byte packets
 1  sol (  0.295 ms  0.252 ms  0.243 ms
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *

I am not sure whether my configuration is incorrect, or whether I might be running into a problem with the wireless access point.

I've tried adding ebtables configuration (as discussed here) to do MAC translation, but that did not make any difference. I've attempted to add a separate bridge network device outside of virsh, but the existing virtual devices cannot be attached to any other bridges. I've considered other options like a virsh filter or perhaps some iptables rules, but I'm grasping at straws.

Can someone suggest the right way to approach this?

  • For what it's worth (two years later), I now think that this is probably something specific to the ASUS RT-N66U router I have been using. I switched to a different router running OpenWrt, and now the guests on the 192.168.2 network can ping devices on the 192.168.1 network. – Ken Pronovici Oct 14 '18 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.