There's a new server that is assigned 5 IP addresses. I want to use Xen to run several VMs with various services.

This is my first attempt to install Xen, I use this tutorial as a guideline. Stuck in the very beginning: they talk about replacing a single ip on an eth0 with a bridge br0. My server has 5: eth1 and 4 aliases eth1:1 .. eth1:4.

How should the network config look like?

  1. bridge that replaces eth1 completely, and then 4 aliases added to the bridge?
  2. bridge can only replace a single IP out of the 5?

Pardon my lame questions, first time in this forest.

  • Bridge doesn't replace IPs at all, it rather substitutes primary network interface. Since aliases aren't interfaces, but are just additional IP-addresses, you possibly can now answer your own question. ;)
    – poige
    Commented Oct 14, 2012 at 17:04

2 Answers 2


1 advice with xen, if you decide to use classic bridge (vs ovs), set it manually as the scripts didn't get it right for me at first (with the single nic being locked out)

something like this should get bridging to work:

auto lo br0
iface lo inet loopback

iface br0 inet static
        bridge_ports eth1
        bridge_stp off
        bridge_fd 0
        #bridge_hello 2
        #bridge_maxage 12

iface eth1 inet manual

Now on every guest os you will get an 'eth0' interface (rfr. bridge_fd=0), if you assign a ip address to that interface, it will be on the br0 bridge and will be able to do everything like the host can, given the fact that nothing is blocking it (netfilter etc)

for completeness sake, then you edit /etc/sysctl.conf (assuming debian here,sry) and set this as it might be needed for your network

net.ipv4.conf.eth1.proxy_arp = 1
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

and do sysctl -p to commit them. This disables netfilter from intervening on the bridge. Alternatively you could use iptables to do this too. from top of my head, something like this (they might not all be needed), but since I don't use these, it's just to give an idea:

iptables -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
iptables -I FORWARD -m physdev --physdev-in vif1.0 -j ACCEPT

That vif1.0 (or perhaps named a bit different) interface will be shown once your guest os is started, you can check the network on the host with the classic tools (ip, ifconfig etc).


You need to: Get rid of the aliases eth1:1 through eth1:4, set up the bridge on your existing `eth1 interface, and then go on with life.

  • Sounds good but too little detailed to understand for myself. Care to elaborate? I found instructions for one VM but not for more than one. I thought a bridge can only have two endpoints, but then can I attach more than one bridge to eth0? They need one public IP each inside the VM.
    – Ned64
    Commented Mar 14, 2020 at 7:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .