Qemu (kvm) internal network setup

I got a new notebook, a nice Thinkpad T61 with virtualization technology. I need to run some Windows system for development so I’ve decided to use the Kernel based Virtual Machine (KVM). The VMs should communicate over an internal network but should have access to the internet and I want access via network to them. So I setup a bridge with TUN/TAP devices masqueraded to my normal interface.

               HOST            QEMU GUEST1
        +---------------+   +--------------+
        |   |   |              |
 LAN ---+---- eth0      |   |              |
        |               |   |              |    QEMU GUEST2
        |   +------+ +--+---+---- nic0     |   +--------------+
        |   | tap0---+  |   | |   |              |
        |   | tap1---+  |   +--------------+   |              |
        |   +------+ |  |                      |              |
        |     br0    +--+----------------------+---- nic0     |
        ||                      | |
        +---------------+                      +--------------+

Needed packages:

tunctl (uml-utilities)

Setup the network:

Create a file call kvm-network with the following content and make it executeable.


KVMNET_GID=$(grep kvm /etc/group | cut -d ':' -f 3)

# number of TUN/TAP devices to setup

case $1 in
                modprobe kvm
                modprobe kvm_intel

                modprobe tun
                echo "Setting up bridge device br0"
                brctl addbr br0
                ifconfig br0 netmask up
                for ((i=0; i < NUM_OF_DEVICES ; i++)); do
                        echo -n "Setting up "
                        tunctl -b -g ${KVMNET_GID} -t kvmnet$i
                        #tunctl -b -u ${KVMNET_UID} -t kvmnet$i
                        brctl addif br0 kvmnet$i
                        ifconfig kvmnet$i up promisc
                SuSEfirewall2 stop
                for ((i=0; i < NUM_OF_DEVICES ; i++)); do
                        ifconfig kvmnet$i down
                        brctl delif br0 kvmnet$i
                        tunctl -d kvmnet$i
                ifconfig br0 down
                brctl delbr br0
                SuSEfirewall2 stop

                rmmod kvm_intel
                rmmod kvm
                echo "Usage: $(basename $0) (start|stop)"

br0 is the gateway to the external network.

Setting up the firewall:

Edit /etc/sysconfig/SuSEfirewall and set the following variables:

FW_DEV_INT="br0 qtap0 qtap1 qtap2 qtap3 qtap4"

If you don't run a SUSE system use the following lines to setup masquerading:

echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

On the guest you have to set the default gateway to which is the bridge br0 and take a look in /etc/resolv.conf to get the name servers. I run a Windows 2003 Server as a guest which is the dhcp and name server for the other guests (Vista, several Linux installations).

Setting up qemu

Guest 1:


qemu-kvm /path/to/vm.img \
          -net nic,model=rtl8139,macaddr=52:54:00:12:34:56 \
          -net tap,ifname=qtap0,script=no \
          -m 256 \
          -smp 1 \
          -usb \
          -usbdevice tablet \

Guest 2:


qemu-kvm /path/to/vm2.img \
          -net nic,model=rtl8139,macaddr=52:54:00:12:34:57 \
          -net tap,ifname=qtap1,script=no \
          -m 256 \
          -smp 1 \
          -usb \
          -usbdevice tablet \

Note that the VMs have different MAC addresses. It took me a long time to find why I couldn't ping from one guest to another 😉 By the way, one of the guests is running Vista, which runs smoothly on my machine with KVM.

You may also like...

33 Responses

  1. diegowsky says:

    on ubuntu 7.04, the package “bridge-utilities” is called “bridge-utils”

  2. Andrei says:

    Hi, Andreas !

    Thanks a LOT for KVM networking setup advice. Can you please tell me if this will work with Kernel 2.6.22, and not SuSE 2.6.18 ? Something has changed in the bridging stuff starting from 2.6.20 kernel.

    Thanks in advance for any suggestion(s)

  3. GlaDiaC says:


    I’ve done this on my notebook which is running openSUSE 10.3 Beta with Kernel 2.6.22.

  4. dean says:


    I’ve spent some time looking for he reason why I could not ping between guests. When I check the bridge from the host brctl showmacs br0 it shows different addresses. Your wink prompted me to run ifconfig on each guest, sure enough, they are the same mac. Thank you!

  5. Dave says:


    I want the guest OS’s to join the other networks windows work group, how is this possible?

  6. GlaDiaC says:

    Dave, please be more precise!

  7. Dan says:


    I couldn’t make it work. My guests (both Ubuntu & WinXP) haven’t got connection. I think everything was setup exactly like the instruction. I just slightly changed the UserID as 0 since I ran as root.

    I wonder if is that correct when I assign NIC_0 (guest_1) as the same value as TAP_0 (Tap)?


  8. Dan says:

    I’m sorry for last post since my firewall system wasn’t on as I thought. Using 2-line script to setup the masquerading is great. I got everything works now. Thanks!

  9. Marcin says:

    I’m trying to get this working in Windows 2003, but the machine hangs dead when installing the kvmnet.sys driver. Here is my startup script:
    qemu-kvm \
    -M pc \
    -cdrom /ISO/kvm-driver-disc-20080318.iso \
    -m 512 \
    -name janus1 \
    -smp 2 \
    -net nic,model=virtio \
    -net tap,ifname=tap0,script=no \
    -no-acpi \

    Thanks for great guide.

  10. Marcin says:

    Nevermind, figured out that part, seems that the version doesn’t play nice. Upgraded to and work like a charm – 1Gbps in the system tray…:))
    I’ve set up bridging using the guide at: http://www.linux-kvm.com/content/tip-how-get-maximum-network-performance-using-paravirtual-drivers-and-bridged-networking but doesn’t work, my virt machine can’t get na ip from dhcp. Help greatly appreciated

  11. Mic says:

    Nice tutorial but i can’t make it work on Opensuse 11.
    Everything seems fine except an “commit failed on table filter: No chain/target/match by that name” error with firewall (standard setup).
    VM can ping the host but can’t go on the internet.
    It seems my problem came from MASQUERADE (unable to activate it) but i haven’t found how to solve it.
    Any help appreciated.

  12. frank says:

    edit /etc/sysconfig/SuSEfirewall2 instead of /etc/sysconfig/SuSEfirewall.
    FW_FORWARD_ALWAYS_INOUT_DEV is deprecated, so don’t use it.

    Great work. You could have avoid some trouble with MAC adresses by setting them in kvm-network.sh with something like this:
    ip link set dev qtap$i up promisc on address 52:54:00:12:34:5$i

  13. pravin says:

    thanks, helped me to setup guest networking 🙂

  14. Jeremy Brown says:

    “Note that the VMs have different MAC addresses. It took me a long time to find why I couldn’t ping from one guest to another”

    This did the trick for me as well. I was able to ping one or the other, but not both back to back. It was weird. In retrospect it must have been having a hard time figuring out which “NIC” to route to.

    Now I can contact multiple KVM instances over the network without issue. Thanks for the tip!

  15. Seed says:

    Hi, Andreas !

    Thanks a lot, this is perfect!

    I repeat if you cannot communicate between both VM, BEWARE of MAC addresses, I looked for hours before find out this tutorial 😉

  16. The br/tap script is awesome, it brings the net devices right up. I can assign the correct IP/netmask/gateway to each VM via the mac address with dhpcd3. The VM’s can ping out to the internet just fine. However I can not ping to the VMs. If I try assigning an ip to qtap1 (ifconfig qtap1, then I can ping it, however the network on that VM stops. ifconfig qtap1 revives it again. It makes sense that it can’t be pinged because that IP does not show up under ifconfig. This is what a qtap interface looks like that works outbound only:

    qtap1 Link encap:Ethernet HWaddr 00:ff:2e:0b:24:af
    inet6 addr: fe80::2ff:2eff:fe0b:24af/64 Scope:Link
    RX packets:111 errors:0 dropped:0 overruns:0 frame:0
    TX packets:23 errors:0 dropped:27 overruns:0 carrier:0
    collisions:0 txqueuelen:500
    RX bytes:15056 (14.7 KiB) TX bytes:2322 (2.2 KiB)

    I’m running the 2.6.26 kernel, did something change?

    P.S. Your ascii art diagram of the network is the best illustration of bridged networking I’ve come across.

  17. GlaDiaC says:

    If you want to connect to the machines from external, you have to add your network card to the bridge.

  18. The only IP that can ping is the XP VM itself. Adding eth0 to br0 changes the IP of br0 to what eth0 was; I have dhcpcd giving the VM on qtap1 an IP of Again, the only IP that can ping is If I could get the Host Linux machine to be able to ping the guests I could set up port forwarding on iptables to resolve the rest.

  19. Ok, I can’t ping, however nmap detects it:
    All 1715 scanned ports on are filtered
    MAC Address: 52:54:00:12:34:51 (QEMU Virtual NIC)

    I guess this infers that it’s a firewall issue after all?

  20. I was overlooking the obvious – yes it was a firewall issue – but from the XP guest. I guess I’m not used to the XP firewall stopping ICMP ping packets but this fresh install did.

    Again – thanks for the great how-to.

  21. Gopalakrishnan says:

    Can someone help me . I have a Fedora 10 guest running on a KVM with Fedora9 host .
    I see vibr0 up and running with a valid ip already . But all my attempts to get the networking going on the guest fails .
    what should be the right argument to the -net when i start the guest so that it works .

  22. knura says:

    Thanks very much for this article. Concise and precise. Requires basic networking knowledge in Linux but that is a fair assumption.

  23. Raja says:

    Dude, I’ve been looking for a guide like this. Thanks.

  24. Bastiaan says:

    I use gentoo with kernel 2.6.31 and have kvm-88 build in the kernel so I had to comment the load modules.

    thanks for the guild, as my wiki (http://en.gentoo-wiki.com/wiki/KVM#Networking) used it 😉

  25. Sivaram Kannan says:

    Wow. That is a great guide. It cleared lot of my doubts. The script worked great. Great work.

  26. satria says:

    how to connect OS “ubuntu 9:10” as the host, with Qemu as a guest.?
    I can not connect from the host to geust, how to connect?
    I use Samba to connect the host to the guest.
    I was able to ping from guest to host, but from host to guest can not ping .. why?

    the answer to my email please

  27. Tom says:

    try different driver for KVM VGA, like curris. Check Qemu-kvm page, works better on Win7/Vista VMs.

  28. Ehsan says:

    Why you start the guest with `ifname=qtap0` while your created interface was `kvmnet0`?
    My guest didn’t ping the host, but as soon as I start that with `ifname=kvmnet0`, it works!

    I don’t know the real solution and I don’t know what kind of problem may occurred by this change. Would you please explain a little about it.


  29. BronzeByte says:

    Very useful and with beautiful ASCII diagram 😉

  1. Monday, May 11, 2009

    […] (I get various german mirrors). So I asked around and Jan suggested the setup of Gladiac, but it didn’t want to fly for me. So I continued experimenting and went to Luwdig for some […]

  2. Thursday, January 21, 2010

    […] echo à ce très bon post montrant une configuration réseau qui fonctionne pour qemu / kvm, je vous propose ma petite sauce. […]

  3. Monday, February 1, 2010

    […] Qemu (kvm) internal network setup | Andreas Schneider – GlaDiaC’s strace (tags: kvm virtualization network bridging) This was written by andy. Posted on Monday, February 1, 2010, at 1:41 am. Filed under Delicious. Bookmark the permalink. Follow comments here with the RSS feed. Post a comment or leave a trackback. […]

Leave a Reply

Your email address will not be published. Required fields are marked *