Is there a way to setup QEMU TAP networking without allocating a TAP device for each VM?

My goal is to preconfigure QEMU TAP networking with NAT (as root), and be able to run an arbitrary number of virtual machines (as a regular user in the kvm group).

I'm using the following commands to configure QEMU TAP networking with NAT:

Set up a bridge and a TAP device:

usermod -aG kvm $USER

ip link add name br0 type bridge
ip addr add dev br0
ip link set br0 up

ip tuntap add dev tap0 mode tap group kvm
ip link set tap0 up promisc on
ip link set tap0 master br0

sysctl net.ipv4.ip_forward=1

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT

Run QEMU with the TAP device (as a regular user):

qemu-system-x86_64 \
    -device virtio-net,netdev=network0 -netdev tap,id=network0,ifname=tap0,script=no,downscript=no \
    # ...

The VM can then access the internet (after configuring its internal network interface).

However it appears the TAP device cannot be used concurrently. Attempting to run another instance of QEMU produces the following error:

qemu-system-x86_64: could not configure /dev/net/tun: Operation not permitted

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.