Skip to main content ↑ ↓
Topic solved
This topic has been marked as solved and requires no further attention.
Topic: virbr0 has no master interfaces (Read 3813 times) previous topic - next topic
0 Members and 1 Guest are viewing this topic.

Re: virbr0 has no master interfaces

Reply #15 –
I have nm as my main interface for the host. I have this for my internet aware bridge; my host network is on 192.168.0.1/255 all managed by virt-manager

Code: [Select]
<network>
  <name>vm-internet</name>
  <uuid>c65c8a87-ff55-4eff-bb0e-95e250989547</uuid>
  <forward mode="nat">
    <nat>
      <port start="1024" end="65535"/>
    </nat>
  </forward>
  <bridge name="virbr1" stp="on" delay="0"/>
  <mac address="52:54:00:6b:38:e0"/>
  <domain name="vm-internet"/>
  <dns forwardPlainNames="yes"/>
  <ip address="192.168.123.1" netmask="255.255.255.0">
    <dhcp>
      <range start="192.168.123.128" end="192.168.123.254"/>
    </dhcp>
  </ip>
</network>

Re: virbr0 has no master interfaces

Reply #16 –
Quote from: replabrobin – on
I have nm as my main interface for the host. I have this for my internet aware bridge; my host network is on 192.168.0.1/255 all managed
That's still NAT though?
Can the host and guest ssh to each other?
If they can I've been talking semi nonsense then, but I'm fairly sure that didn't use to be possible?

Re: virbr0 has no master interfaces

Reply #17 –
Well I can certainly see the host network from a VM, but I don't think I have transparent dns across the bridge, but explicit ip works.
Code: [Select]
artix-dinit:[robin]:~$ ping google.com
PING google.com (142.250.187.206) 56(84) bytes of data.
64 bytes from lhr25s33-in-f14.1e100.net (142.250.187.206): icmp_seq=1 ttl=116 time=1.86 ms
64 bytes from lhr25s33-in-f14.1e100.net (142.250.187.206): icmp_seq=2 ttl=116 time=4.38 ms
^C
--- google.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 1.857/3.116/4.375/1.259 ms
artix-dinit:[robin]:~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host proto kernel_lo 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,DYNAMIC,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:3c:6b:ff brd ff:ff:ff:ff:ff:ff
    inet 192.168.123.188/24 brd 192.168.123.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fe3c:6bff/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever
artix-dinit:[robin]:~$ ssh 192.168.0.9
Welcome to Artix
Last login: Fri Jun 27 08:27:49 2025 from 192.168.0.16
You!  What PLANET is this!
		-- McCoy, "The City on the Edge of Forever", stardate 3134.0
robin@delilah:~

I can also ssh directly into the VM using an explicit IP eg
Code: [Select]
[robin@minikat:~
$ ssh 192.168.123.188
artix-dinit:[robin]:~$

Although I have nat in the virtmanager setup I see this in nm
Code: [Select]
$ nmcli connection
NAME        UUID                                  TYPE      DEVICE 
eno1        9cb5f3b0-eb4b-48ee-b2b0-3943c010e2b7  ethernet  eno1   
lo          66bee815-e115-4b0b-bbb3-ea3275fd7afd  loopback  lo     
virbr0      f07e7176-31ad-4bf1-aed4-c13debc255d9  bridge    virbr0 
virbr1      9df63bd0-abbd-4bff-b16e-02757a2b2065  bridge    virbr1 
vnet1       152c0aac-ffe9-4cdb-be3c-524f943a8925  tun       vnet1  
NeuHeimat   77841e45-e6d7-4eca-a405-d3291a517946  wifi      --     
NeuHeimat5  1c435a04-abd4-4efe-b25d-6d1d6814dd39  wifi      --
I don't know where vnet1 comes from, but it's probably from virtmanager somehow.

virtmanager/libvirt puts a lot of stuff into my iptables to do all this eg
Code: [Select]
$ sudo iptables-save | sed -e 's/\[[0-9:]*\]/[0,0]/' -e '/^#/d' | grep LIBVIRT
:LIBVIRT_PRT - [0,0]
-A POSTROUTING -j LIBVIRT_PRT
-A LIBVIRT_PRT -o virbr1 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
-A LIBVIRT_PRT -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
:LIBVIRT_PRT - [0,0]
-A POSTROUTING -j LIBVIRT_PRT
-A LIBVIRT_PRT -s 192.168.123.0/24 -d 224.0.0.0/24 -j RETURN
-A LIBVIRT_PRT -s 192.168.123.0/24 -d 255.255.255.255/32 -j RETURN
-A LIBVIRT_PRT -s 192.168.123.0/24 ! -d 192.168.123.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A LIBVIRT_PRT -s 192.168.123.0/24 ! -d 192.168.123.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A LIBVIRT_PRT -s 192.168.123.0/24 ! -d 192.168.123.0/24 -j MASQUERADE
-A LIBVIRT_PRT -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
-A LIBVIRT_PRT -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN
-A LIBVIRT_PRT -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A LIBVIRT_PRT -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A LIBVIRT_PRT -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
:LIBVIRT_FWI - [0,0]
:LIBVIRT_FWO - [0,0]
:LIBVIRT_FWX - [0,0]
:LIBVIRT_INP - [0,0]
:LIBVIRT_OUT - [0,0]
-A INPUT -j LIBVIRT_INP
-A FORWARD -j LIBVIRT_FWX
-A FORWARD -j LIBVIRT_FWI
-A FORWARD -j LIBVIRT_FWO
-A OUTPUT -j LIBVIRT_OUT
-A LIBVIRT_FWI -d 192.168.123.0/24 -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A LIBVIRT_FWI -o virbr1 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWI -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A LIBVIRT_FWI -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWO -s 192.168.100.0/24 ! -d 192.168.0.0/24 -i virbr1 -j ACCEPT
-A LIBVIRT_FWO -s 192.168.123.0/24 -i virbr1 -j ACCEPT
-A LIBVIRT_FWO -i virbr1 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWO -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A LIBVIRT_FWO -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWX -i virbr1 -o virbr1 -j ACCEPT
-A LIBVIRT_FWX -i virbr0 -o virbr0 -j ACCEPT
-A LIBVIRT_INP -s 192.168.100.0/24 -d 192.168.0.16/32 -i virbr1 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_INP -i virbr1 -p udp -m udp --dport 53 -j ACCEPT
-A LIBVIRT_INP -i virbr1 -p tcp -m tcp --dport 53 -j ACCEPT
-A LIBVIRT_INP -i virbr1 -p udp -m udp --dport 67 -j ACCEPT
-A LIBVIRT_INP -i virbr1 -p tcp -m tcp --dport 67 -j ACCEPT
-A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
-A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A LIBVIRT_OUT -o virbr1 -p udp -m udp --dport 53 -j ACCEPT
-A LIBVIRT_OUT -o virbr1 -p tcp -m tcp --dport 53 -j ACCEPT
-A LIBVIRT_OUT -o virbr1 -p udp -m udp --dport 68 -j ACCEPT
-A LIBVIRT_OUT -o virbr1 -p tcp -m tcp --dport 68 -j ACCEPT
-A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT
-A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 68 -j ACCEPT

Re: virbr0 has no master interfaces

Reply #18 –
I watched connection and machine startup with virt-manager.

My NAT virbr0/1 etc create a bridge device. VM startup creates a tun vnetx which is bridged by the associated virbry.

The virbr startup adds to the iptables, but it doesn't seem to be totally cleaned up when the bridge is stopped.

I find also that I have an excutable network hook /etc/libvirt/hooks/network I forget where that came from; probably a google
maybe https://superuser.com/questions/1842466/how-can-i-create-a-vm-in-virt-manager-that-can-access-the-internet-through-the-h
Code: [Select]
#!/bin/sh
DATA="$(cat)"
TAG="libvirt/hooks/$(basename $0)"
add_rule(){
	local out=$(/usr/bin/iptables $@ 2>&1) || true
	if [ -n "$out" ]; then
		logger -t "$TAG" "'$out'" || true
	fi
}

case "$2" in
	(start)
	#called before it is started
	ls -alrt /var/lib/libvirt/dnsmasq/ > /tmp/libvirt-hooks.log
	;;
	(started)
		case "$1" in
			(vm-internet)
				add_rule -D LIBVIRT_FWO -s 192.168.100.0/24 -i virbr1 -j ACCEPT
				add_rule -I LIBVIRT_FWO -s 192.168.100.0/24 ! -d 192.168.0.0/24 -i virbr1 -j ACCEPT
				add_rule -I LIBVIRT_INP -s 192.168.100.0/24 -d 192.168.0.16 -i virbr1 -j REJECT
			;;
			(*)
			;;
		esac
		;;
	(stopped)
		#called after it is stopped
		case "$1" in
			(vm-internet)
				add_rule -D LIBVIRT_FWO -s 192.168.100.0/24 ! -d 192.168.0.0/24 -i virbr1 -j ACCEPT
				add_rule -D LIBVIRT_INP -s 192.168.100.0/24 -d 192.168.0.16 -i virbr1 -j REJECT
			;;
			(*)
			;;
		esac
		;;
	(*)
		logger  -t "$TAG" "unknown arg 2 in '$0 $@'" || true
		;;
esac

Re: virbr0 has no master interfaces

Reply #19 –
Quote from: replabrobin – on
Well I can certainly see the host network from a VM, but I don't think I have transparent dns across the bridge, but explicit ip works.
I stand corrected then. Maybe things have changed  with how libvirt handles NAT along the way. Or maybe I've always been wrong ?
I'm fairly sure though that NATwith libvirt used to have drawbacks, compared to bridged connections, when you wanted to ssh between host and guest?

I'll be sticking with my system created bridge anyway as it seems simpler to me.

Re: virbr0 has no master interfaces

Reply #20 –
My network hook above is wrong; it should use the 192.168.123.0/24 not 192.168.100.0/24. If I fix it then I finally see what I was trying to do. The virbr1 ie vm-internet connection is supposed to be internet only.  The VM cannot connect to the host network, but the host can see the VM.

My normal default virbr0 can see the internet and also the local network it runs on the default 192.168.122.0/24 net.

Re: virbr0 has no master interfaces

Reply #21 –
Hey, just got some time to work on things now. Thanks so much for the help @gripped, I made a bridge following these instructions for NetworkManager and everything works very well. I can access the internet as normal from my host machine and also without any problems from the guest machines. Not sure why my libvirt-created NAT was behaving so differently to how other people report but no biggie, as long as I have working internet on both my guest and host machines :)