- a physical VM host
- with multiple VMs in qemu-kvm
- and a set of public 8 IPv4 addresses and an IPv6 subnet that I easily want to assign to the VMs.
It equals this chart from Configure public IP addresses in KVM VMs
How to do that?
Currently I use one virtual bridge device to connect physical network with all VM's ethernet ports and simply configure IP in the VMs. Now I want to adopt routed networking for security (VMs can't spoof other VM's IP address) and easier configuration (IP config details not to be entered at every VM install).
My hoster has a larger network (say /24 for IPv4) but configured its switches to route only my IP addresses to my switch port. To signal that the VM's IP addresses are available at my host's MAC address I need to enable ARP proxy.
I use current Debian Linux 9 Stretch with all software from the distribution's packages.
Old school manual solution?
I think I could create a bridge device in Linux and setup a DHCP server for every IPv4 address and iptables rules manually and connect each VM to one of the bridges. But libvirt seems to have capabilities to simplify that.
The best description of a similar setup I could find is https://jamielinux.com/docs/libvirt-networking-handbook/routed-network.html
I find it cumbersome to copy the MAC address of the VM's ethernet port and rewrite the XML file of the network and restart the network for all VMs. Instead I'd like to select the IPv4 address when setting up the VM.
I think creating 1 network per IPv4 address with a name like
static-192.168.1.2 (with a public IP address then) and a DHCP range for only that address would allow that. For more addresses this might not scale but for 8 I consider this. Is there a better solution?
I tried to create a network reflecting the local net with a short DHCP range to provide two example IPv4 addresses in a test setup. 192.168.23.0/24 is the local net and the VM host has 192.168.23.7 on
<network> <name>static</name> <bridge name="br1" /> <forward mode="route"/> <ip address="192.168.23.1" netmask="255.255.255.0"> <dhcp> <range start="192.168.23.8" end="192.168.23.10"/> </dhcp> </ip> </network>
but I it can't start
# virsh net-create net.xml error: Failed to create network from net.xml error: internal error: Network is already in use by interface br1
I already configured a bridge connected to the physical interface because I thought the host's IPv4 on that interface would lock it. How to define a routed libvirt network with a DHCP that contains a single IPv4 address from the local net?
I find this quite complex because I never really worked with libvirt yet and probably some information is missing. I'll update the question as necessary.