3

I have a home network 192.168.1.0 behind a router 192.168.1.1. A set of existing Linux and Windows hosts are on this network, most on wired ethernet connections. I am configuring a new server that runs a KVM hypervisor and 3 Debian guests. The new server uses wifi for network connectivity.

On the hypervisor, I used virsh to configure a virtual network like this:

<network>
  <name>virtual</name>
  <forward mode='route'/>
  <ip address='192.168.2.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.2.2' end='192.168.2.255'/>
      <host mac='52:54:00:00:00:01' ip='192.168.2.2'/>
      <host mac='52:54:00:00:00:02' ip='192.168.2.3'/>
      <host mac='52:54:00:00:00:03' ip='192.168.2.4'/>
    </dhcp>
  </ip>
</network>

Then, I created a static route in my router from 192.168.2.0/24 to the hypervisor's IP address of 192.168.1.41.

When I created the Debian guests, I specified the virtual network name and the MAC addresses from the virsh virtual network, like this:

--network network=virtual,mac=52:54:00:00:00:01

This results in /etc/network/interfaces like this on each guest:

iface eth0 inet static
   address 192.168.2.2
   netmask 255.255.255.0
   network 192.168.2.0
   broadcast 192.168.2.255
   gateway 192.168.2.1

With this configuration in place, things mostly work. I can:

  • Connect from hosts on 192.168.1.0 to both hypervisor IP addresses (.2.1 and .1.41)
  • Connect from hosts on 192.168.1.0 to each guest
  • Connect from the hypervisor to each guest
  • Connect from each guest to the hypervisor (.2.1) and to each other guest
  • Connect from each guest to the public internet
  • Forward external (internet) connections from the router to individual guests

However, I cannot connect from the guests to any host on the 192.168.1.0 network. For instance, I can't ssh from 192.168.2.2 to 192.168.1.31.

A traceroute shows something like this:

traceroute to 192.168.1.31 (192.168.1.31), 30 hops max, 60 byte packets
 1  sol (192.168.2.1)  0.295 ms  0.252 ms  0.243 ms
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *

I am not sure whether my configuration is incorrect, or whether I might be running into a problem with the wireless access point.

I've tried adding ebtables configuration (as discussed here) to do MAC translation, but that did not make any difference. I've attempted to add a separate bridge network device outside of virsh, but the existing virtual devices cannot be attached to any other bridges. I've considered other options like a virsh filter or perhaps some iptables rules, but I'm grasping at straws.

Can someone suggest the right way to approach this?

  • For what it's worth (two years later), I now think that this is probably something specific to the ASUS RT-N66U router I have been using. I switched to a different router running OpenWrt, and now the guests on the 192.168.2 network can ping devices on the 192.168.1 network. – Ken Pronovici Oct 14 '18 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.