How do I set up an easy QEMU virtual machine network that I can quickly filter with iptables but not use a bridge or tap interface etc?

1 Answer 1


Ok ok, run qemu from a systemd-nspawn container WITH user isolation (-U flag). All container processes then will be of format: "vu-containername-number", including qemu. You can then create iptables filters for this virtual user containerized qemu process and all your traffic to/from container will be taken care of (iptables ... -m owner --uid-owner vu-blah-blah ... -j). Zero need for any network setups and added security from containerization.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .