Is there a way to setup QEMU TAP networking without allocating a TAP device for each VM?
My goal is to preconfigure QEMU TAP networking with NAT (as root), and be able to run an arbitrary number of virtual machines (as a regular user in the kvm group).
I'm using the following commands to configure QEMU TAP networking with NAT:
Set up a bridge and a TAP device:
usermod -aG kvm $USER ip link add name br0 type bridge ip addr add 10.0.0.1/24 dev br0 ip link set br0 up ip tuntap add dev tap0 mode tap group kvm ip link set tap0 up promisc on ip link set tap0 master br0 sysctl net.ipv4.ip_forward=1 iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT
Run QEMU with the TAP device (as a regular user):
qemu-system-x86_64 \ -device virtio-net,netdev=network0 -netdev tap,id=network0,ifname=tap0,script=no,downscript=no \ # ...
The VM can then access the internet (after configuring its internal network interface).
However it appears the TAP device cannot be used concurrently. Attempting to run another instance of QEMU produces the following error:
qemu-system-x86_64: could not configure /dev/net/tun: Operation not permitted