You'll have to excuse me, I'm not particularly tech savvy when it comes to networking...

I am using a host/VM machine model and need to connect both to the internet but under different physical network interfaces. So my question is this: How do I connect my two physical network interfaces to the internet, preferably with different IPs, while only allowing the host to use one to connect to the internet? So if eth0 is disconnected and eth1 is connected, the host wouldn't be able to resolve anything but any VM connected to eth1 could.

Is this even possible?

  • the network interfaces of the VMs probably show up as interfaces on the host too (or rather, their connections links with one end an interface on the host, and another an interface on the VM). Make bridge (man brctl etc.) with those interfaces and eth1 together, and don't set an IP address to any of them on the host.
    – ilkkachu
    Commented Jul 11, 2021 at 22:59
  • @ilkkachu So it appears I don't need a bridge connection specifically. Macvtap works too. I set the interface to manual with nothing else auto eth1 iface eth1 inet manual but am not totally convinced it worked as intended. Does this ip addr look okay to you? eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000 link/ether e4:ee:fd:4d:31:86 brd ff:ff:ff:ff:ff:ff inet brd scope global dynamic eth1 eth1 is currently connected btw. Commented Jul 11, 2021 at 23:49
  • One way is to assign eth1 to the VM and not the host in whatever setup your VM has. Another way is to give your VM a macvlan interface, details depend again on your VM. Your VM will always assign its own IP address to any interfaces it has; only if you configure your VM to "share internet with the host" (this is named differently for different ways to make VMs) it will use the same IP address.
    – dirkt
    Commented Jul 12, 2021 at 5:04
  • This can also be solved by routing and policy routing rule to change behavior between routed VMs and the host (ie the router when not routing traffic). Now if OP is using public IP addresses in a single LAN (rather than having the router on two public LANs as should normally be expected of a router) macvlan is probably easier. If instead VMs are in a private LAN (eg: libvirt's or the system is across two public IP LANs then filtering could be done as usual and this setup might be easier in the end. If you give more feedback on your setup I could give such alternate answer.
    – A.B
    Commented Jul 25, 2021 at 18:31

1 Answer 1


It appears, at least for now, to be functioning as intended.

So what you need to do is:

  1. set the network interface in question to manual in the /etc/network/interfaces file. Something like auto eth1 iface eth1 inet manual. If, when said interface has been brought down and back up, the output of ip -o route get 8/8 | grep --color=always 'dev [^ ]*' does not list the network interface it should mean it worked.
  2. set a macvtap interface on the vm with the network interface as the device name. Or, if using plain QEMU, a bridge set up in likewise fashion.
  3. If ping doesn't work on host but does work on the VM you're golden.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .