I cannot get networking inside a guest VM to work with KVM on a Raspberry Pi 4 8GB running the official Ubuntu 20.04 image. I have my networking configured correctly, as far as I can tell. And I'm really hoping someone will tell me I did something wrong and can point me to better documentation. I've been through netplan's docs, a dozen different tutorials on KVM setup, and have even looked at some QEMU docs related to CPU config, because I found that QEMU isn't nearly as well built out for aarch64 as it is for x86_64.
I installed KVM through the same means as I have found in a dozen tutorials:
$ sudo apt install qemu qemu-kvm libvirt-clients libvirt-daemon-system virtinst bridge-utils
$ sudo systemctl enable libvirtd
$ sudo systemctl start libvirtd
Here is my netplan:
$ cat /etc/netplan/01-netcfg.yaml
network:
ethernets:
eth0:
dhcp4: false
dhcp6: false
optional: true
nameservers:
addresses: [1.1.1.1, 1.0.0.1]
wifis:
wlan0:
dhcp4: true
dhcp6: false
optional: true
access-points:
"censored":
password: "censored"
bridges:
br0:
interfaces: [eth0]
nameservers:
addresses: [1.1.1.1, 1.0.0.1]
parameters:
stp: true
forward-delay: 4
dhcp4: true
dhcp6: false
version: 2
renderer: networkd
And then I defined it for the KVM domain:
$ sudo mkdir -p /opt/kvm
$ sudo nano /opt/kvm/host-bridge.xml
<network>
<name>host-bridge</name>
<forward mode="bridge"/>
<bridge name="br0"/>
</network>
$ virsh net-define /opt/kvm/host-bridge.xml
$ virsh net-start host-bridge
$ virsh net-autostart host-bridge
I then checked that it's actually present and configured proper:
$ virsh net-list --all
Name State Autostart Persistent
--------------------------------------------------
default inactive no yes
host-bridge active yes yes
After starting the VM creation, I checked that its vnet0 gets added to the bridge properly:
$ sudo virt-install --name Test-VM --ram=2048 --vcpus=2 --cpu max --hvm --disk path=/opt/vhd/test-vhd,size=16 --cdrom /opt/iso/ubuntu-20.04.1-live-server-arm64.iso --network bridge=br0 --graphics vnc
$ virsh domiflist Test-VM
Interface Type Source Model MAC
-----------------------------------------------------------
vnet0 bridge br0 virtio 52:54:00:64:58:9e
$ brctl show
bridge name bridge id STP enabled interfaces
br0 8000.dca632b43f5b yes eth0
vnet0
docker0 8000.0242aa58079a no
docker1 8000.024296884d89 no veth239b4dd
veth76e81fc
vethdffe7c7
vethef20e5a
However, after all of this, networking inside of my guest doesn't seem to work. It just spins and spins trying to get an IP address, but it never gets one. Is there something I've missed?
I also checked that the VM is actually using the bridged interface, and it seems like it is:
$ virsh edit Test-VM
...
<interface type='bridge'>
<mac address='52:54:00:64:58:9e'/>
<source bridge='br0'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
</interface>
...
Here's a screen of the guest just spinning. As you can see, I have full network capabilities through the bridge interface on the host to connect to KVM through VNC. Screenshot
Okay, the one thing I kept overlooking was my firewall. The firewall was blocking my guests from being able to communicate across the bridge. I don't fully understand the problem, but I at least have an idea of what is going on thanks to this bug report: https://bugs.launchpad.net/ubuntu/+source/ufw/+bug/573461
So to fix the issue, I did this:
$ sudo nano /etc/default/ufw
And then change this
IPT_MODULES=""
to this
IPT_MODULES="bridge"
Then I go to this file:
$ sudo nano /etc/ufw/sysctl.conf
And append this to the end of it:
# Don't filter packets to our libvirt guests
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0
Then reload the firewall:
$ sudo ufw reload
Now my guests are fully able to access my network as if they were physical machines, while my host machine stays properly firewalled.
If someone has a 'for dummies' explanation of what exactly I'm doing here, please feel free to share. Best I can figure is that this tells UFW, even though it loads before the network config, to expect there to be bridges, and to not filter them. Or at least that's what I think it's doing.
Collected from the Internet
Please contact [email protected] to delete if infringement.
Comments