I am now trying to host two VMs directly by qemu, without any tools like libvirt.

I did setup the bridge/tap interfaces for each of them like

ip link add br0 type bridge
ip addr add dev br0
ip link set br0 up

ip tuntap add mode tap tap0
ip link set tap0 master br0
ip link set tap0 up             // tap1 as well

and launch VMs by command:

qemu-system-x86_64 -enable-kvm -m 1G \
-cdrom archlinux-2018.12.01-x86_64.iso \
-drive file=vm.raw,format=raw,id=hd0 \
-device virtio-net,netdev=network0 \
-netdev tap,id=network0,ifname=tap0,script=no,downscript=no \
-device virtio-net,netdev=network1 \
-netdev user,id=network1 \

Note that I assign two network card intentionally. The user network ensures that the VMs can access Internet, and I want the tap network available as a subnet. I assign manual IPs to the VMs' network interface in their console.

With this setup, the host can ping each VM, and each VM can ping the host, but VM0 just cannot ping VM1 and vice versa. I tried to play around with the iptable rules like

iptables -A FORWARD -i br0 -o br0 -j ACCEPT
iptables -t nat -A POSTROUTING -s -j MASQUERADE

But still in vain.

Clarification 1. (to sourcejedi)

As you can see this launch command is a liveCD of Arch Linux. This boot directly into shell. By default, the interface from tap has no IP nor route settings.

The qemu is 3.0.0. Host is Arch Linux.

Clarification 2.

It turns out that the default MAC are both 52:54:00:12:34:56, so they cannot establish any communication.

  • tcpdump bypasses iptables. When pinging between VMs, if you run tcpdump inside the VMs tcpdump show 1) the ECHO request being received 2) the ECHO reply being received ?
    – sourcejedi
    Dec 13, 2018 at 9:45
  • but you must have set up some network configuration inside the guests, otherwise the host would have nothing to ping. What is that configuration?
    – sourcejedi
    Dec 13, 2018 at 9:48
  • @sourcejedi Nothing more than one line "ip addr add dev ens3" Dec 13, 2018 at 9:50
  • Have you enabled IP forwarding in the host? Dec 13, 2018 at 10:22
  • "It turns out that the default MAC are both 52:54:00:12:34:56, so they cannot establish any communication." Sounds like you found the answer :-). This site allows and encourages you to post answers for your own questions.
    – sourcejedi
    Dec 13, 2018 at 15:19

1 Answer 1


In theory, once two taps are attached the VMs and both of them connects to a bridge on the host with proper IP setup (DHCP or manual), they should be able to ping each other without iptable tweaks.

This question stems from the fact that I launch each VM by an over-simplified command, which assign all network devices an identical MAC address. That is to say, one should always assign distinct MAC addresses to her virtual cluster, such as a simple augmentation to the original command:

-device virtio-net,netdev=network0,mac=52:54:01:12:34:56

And finally, thanks for all the hints from sourcejedi!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .