Setting up Qemu with a tap interface

qemu-networking.md

Setting up Qemu with a tap interface

There are two parts to networking within QEMU:

• The virtual network device that is provided to the guest (e.g. a PCI network card).
• The network backend that interacts with the emulated NIC (e.g. puts packets onto the host's network).

Example: User mode network

User mode networking allows the guest to connect back to the outside world through TCP, UDP etc. ICMP Ping is not allowed. Also connections from host to guest are not allowed unless using port forwarding.

$ qemu-system-i386 -cdrom Core-current.iso -boot d -netdev user,id=mynet0,hostfwd=tcp::8080-:80 -device e1000,netdev=mynet0

-netdev user,id=mynet0,hostfwd=tcp::8080-:80

Create the user mode network backend having id mynet0. Redirect incoming tcp connections on host port 8080 to guest port 80. The syntax is hostfwd=[tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport

-device e1000,netdev=mynet0

Create a NIC (model e1000) and connect to mynet0 backend created by the previous parameter

Example: Tap network

TAP network overcomes all of the limitations of user mode networking, but requires a tap to be setup before running qemu. Also qemu must be run with root privileges.

$ sudo qemu-system-i386 -cdrom Core-current.iso -boot d -netdev tap,id=mynet0,ifname=tap0,script=no,downscript=no -device e1000,netdev=mynet0,mac=52:55:00:d1:55:01

-netdev tap,id=mynet0,ifname=tap0,script=no,downscript=no

Create a tap network backend with id mynet0. This will connect to a tap interface tap0 which must be already setup. Do not use any network configuration scripts.

-device e1000,netdev=mynet0,mac=52:55:00:d1:55:01

Create a NIC (model e1000) and connect to mynet0 backend created by the previous parameter. Also specify a mac address for the NIC.

Setup

• Create a bridge

   brctl addbr br0
  

• Clear IP of eth0

   ip addr flush dev eth0
  

• Add eth0 to bridge

   brctl addif br0 eth0
  

• Create tap interface

   tunctl -t tap0 -u `whoami`
  

• Add tap0 to bridge

   brctl addif br0 tap0
  

• Make sure everything is up

   ifconfig eth0 up
   ifconfig tap0 up
   ifconfig br0 up
  

• Check if properly bridged

   brctl show
  

• Assign ip to br0

   dhclient -v br0
  

Cleanup

• Remove tap interface tap0 from bridge br0

  brctl delif br0 tap0
  

• Delete tap0

  tunctl -d tap0
  

• Remove eth0 from bridge

  brctl delif br0 eth0
  

• Bring bridge down

  ifconfig br0 down
  

• Remove bridge

  brctl delbr br0
  

• Bring eth0 up

  ifconfig eth0 up
  

• Check if an IP is assigned to eth0, if not request one

  dhclient -v eth0
  

dhclient - Auto configuration using a DHCP server

• Release IP

  dhclient -v -r <interface>
  

• Request IP

  dhclient -v <interface>
  

References

• http://www.linux-kvm.org/page/Networking
• http://www.naturalborncoder.com/virtualization/2014/10/14/understanding-bridges/
• http://www.naturalborncoder.com/virtualization/2014/10/17/understanding-tun-tap-interfaces/
• https://wiki.qemu.org/Documentation/Networking
• https://en.wikibooks.org/wiki/QEMU/Networking
• http://blog.elastocloud.org/2015/07/qemukvm-bridged-network-with-tap.html
• http://brezular.com/2011/06/19/bridging-qemu-image-to-the-real-network-using-tap-interface/

qemu-options.txt

QEMU emulator version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.16), Copyright (c) 2003-2008 Fabrice Bellard
usage: qemu-system-i386 [options] [disk_image]

'disk_image' is a raw hard disk image for IDE hard disk 0

Standard options:
-h or -help     display this help and exit
-version        display version information and exit
-machine [type=]name[,prop[=value][,...]]
                selects emulated machine ('-machine help' for list)
                property accel=accel1[:accel2[:...]] selects accelerator
                supported accelerators are kvm, xen, tcg (default: tcg)
                kernel_irqchip=on|off controls accelerated irqchip support
                vmport=on|off|auto controls emulation of vmport (default: auto)
                kvm_shadow_mem=size of KVM shadow MMU
                dump-guest-core=on|off include guest memory in a core dump (default=on)
                mem-merge=on|off controls memory merge support (default: on)
                iommu=on|off controls emulated Intel IOMMU (VT-d) support (default=off)
                igd-passthru=on|off controls IGD GFX passthrough support (default=off)
                aes-key-wrap=on|off controls support for AES key wrapping (default=on)
                dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
                suppress-vmdesc=on|off disables self-describing migration (default=off)
-cpu cpu        select CPU ('-cpu help' for list)
-smp [cpus=]n[,maxcpus=cpus][,cores=cores][,threads=threads][,sockets=sockets]
                set the number of CPUs to 'n' [default=1]
                maxcpus= maximum number of total cpus, including
                offline CPUs for hotplug, etc
                cores= number of CPU cores on one socket
                threads= number of threads on one CPU core
                sockets= number of discrete sockets in the system
-numa node[,mem=size][,cpus=cpu[-cpu]][,nodeid=node]
-numa node[,memdev=id][,cpus=cpu[-cpu]][,nodeid=node]
-add-fd fd=fd,set=set[,opaque=opaque]
                Add 'fd' to fd 'set'
-set group.id.arg=value
                set <arg> parameter for item <id> of type <group>
                i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
                set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
      [,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
                'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
                'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
                'sp_time': the period that splash picture last if menu=on, unit is ms
                'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m[emory] [size=]megs[,slots=n,maxmem=size]
                configure guest RAM
                size: initial amount of guest memory
                slots: number of hotplug slots (default: none)
                maxmem: maximum amount of guest memory (default: none)
NOTE: Some architectures might enforce a specific granularity
-mem-path FILE  provide backing storage for guest RAM
-mem-prealloc   preallocate guest memory (use with -mem-path)
-k language     use keyboard layout (for example 'fr' for French)
-audio-help     print list of audio drivers and their options
-soundhw c1,... enable audio support
                and only specified sound cards (comma separated list)
                use '-soundhw help' to get the list of supported cards
                use '-soundhw all' to enable all of them
-balloon none   disable balloon device
-balloon virtio[,addr=str]
                enable virtio balloon device (default)
-device driver[,prop[=value][,...]]
                add device (based on driver)
                prop=value,... sets driver properties
                use '-device help' to print all possible drivers
                use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
                set the name of the guest
                string1 sets the window title and string2 the process name (on Linux)
                When debug-threads is enabled, individual threads are given a separate name (on Linux)
                NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
                specify machine UUID

Block device options:
-fda/-fdb file  use 'file' as floppy disk 0/1 image
-hda/-hdb file  use 'file' as IDE hard disk 0/1 image
-hdc/-hdd file  use 'file' as IDE hard disk 2/3 image
-cdrom file     use 'file' as IDE cdrom image (cdrom is ide1 master)
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
       [,cyls=c,heads=h,secs=s[,trans=t]][,snapshot=on|off]
       [,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
       [,serial=s][,addr=A][,rerror=ignore|stop|report]
       [,werror=ignore|stop|report|enospc][,id=name][,aio=threads|native]
       [,readonly=on|off][,copy-on-read=on|off]
       [,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
       [[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
       [[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
       [[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
       [[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
       [[,iops_size=is]]
       [[,group=g]]
                use 'file' as a drive image
-mtdblock file  use 'file' as on-board Flash memory image
-sd file        use 'file' as SecureDigital card image
-pflash file    use 'file' as a parallel flash image
-snapshot       write to temporary files instead of disk image files
-hdachs c,h,s[,t]
                force hard disk 0 physical geometry and the optional BIOS
                translation (t=none or lba) (usually QEMU can guess them)
-fsdev fsdriver,id=id[,path=path,][security_model={mapped-xattr|mapped-file|passthrough|none}]
 [,writeout=immediate][,readonly][,socket=socket|sock_fd=sock_fd]
-virtfs local,path=path,mount_tag=tag,security_model=[mapped-xattr|mapped-file|passthrough|none]
        [,writeout=immediate][,readonly][,socket=socket|sock_fd=sock_fd]
-virtfs_synth Create synthetic file system image

USB options:
-usb            enable the USB driver (will be the default soon)
-usbdevice name add the host or guest USB device 'name'

Display options:
-display sdl[,frame=on|off][,alt_grab=on|off][,ctrl_grab=on|off]
            [,window_close=on|off]|curses|none|
            gtk[,grab_on_hover=on|off]|
            vnc=<display>[,<optargs>]
                select display type
-nographic      disable graphical output and redirect serial I/Os to console
-curses         use a curses/ncurses interface instead of SDL
-no-frame       open SDL window without a frame and window decorations
-alt-grab       use Ctrl-Alt-Shift to grab mouse (instead of Ctrl-Alt)
-ctrl-grab      use Right-Ctrl to grab mouse (instead of Ctrl-Alt)
-no-quit        disable SDL window close capability
-sdl            enable SDL
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
       [,x509-key-file=<file>][,x509-key-password=<file>]
       [,x509-cert-file=<file>][,x509-cacert-file=<file>]
       [,x509-dh-key-file=<file>][,addr=addr][,ipv4|ipv6|unix]
       [,tls-ciphers=<list>]
       [,tls-channel=[main|display|cursor|inputs|record|playback]]
       [,plaintext-channel=[main|display|cursor|inputs|record|playback]]
       [,sasl][,password=<secret>][,disable-ticketing]
       [,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
       [,jpeg-wan-compression=[auto|never|always]]
       [,zlib-glz-wan-compression=[auto|never|always]]
       [,streaming-video=[off|all|filter]][,disable-copy-paste]
       [,disable-agent-file-xfer][,agent-mouse=[on|off]]
       [,playback-compression=[on|off]][,seamless-migration=[on|off]]
   enable spice
   at least one of {port, tls-port} is mandatory
-portrait       rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg>   rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
                select video card type
-full-screen    start in full screen
-vnc display    start a VNC server on display

1 target only:
-win2k-hack     use it when installing Windows 2000 to avoid a disk full bug
-no-fd-bootchk  disable boot signature checking for floppy disks
-no-acpi        disable ACPI
-no-hpet        disable HPET
-acpitable [sig=str][,rev=n][,oem_id=str][,oem_table_id=str][,oem_rev=n][,asl_compiler_id=str][,asl_compiler_rev=n][,{data|file}=file1[:file2]...]
                ACPI table description
-smbios file=binary
                load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
              [,uefi=on|off]
                specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
              [,uuid=uuid][,sku=str][,family=str]
                specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
              [,asset=str][,location=str]
                specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
              [,sku=str]
                specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
              [,asset=str][,part=str]
                specify SMBIOS type 4 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
               [,asset=str][,part=str][,speed=%d]
                specify SMBIOS type 17 fields

Network options:
-netdev user,id=str[,net=addr[/mask]][,host=addr][,restrict=on|off]
         [,hostname=host][,dhcpstart=addr][,dns=addr][,dnssearch=domain][,tftp=dir]
         [,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
                configure a user mode network backend with ID 'str',
                its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
         [,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
         [,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
                configure a host TAP network backend with ID 'str'
                use network scripts 'file' (default=/etc/qemu-ifup)
                to configure it and 'dfile' (default=/etc/qemu-ifdown)
                to deconfigure it
                use '[down]script=no' to disable script execution
                use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
                configure it
                use 'fd=h' to connect to an already opened TAP interface
                use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
                use 'sndbuf=nbytes' to limit the size of the send buffer (the
                default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
                use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
                use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
                use vhost=on to enable experimental in kernel accelerator
                    (only has effect for virtio guests which use MSIX)
                use vhostforce=on to force vhost on for non-MSIX virtio guests
                use 'vhostfd=h' to connect to an already opened vhost net device
                use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
                use 'queues=n' to specify the number of queues to be created for multiqueue TAP
-netdev bridge,id=str[,br=bridge][,helper=helper]
                configure a host TAP network backend with ID 'str' that is
                connected to a bridge (default=br0)
                using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
         [,rxsession=rxsession],txsession=txsession[,ipv6=on/off][,udp=on/off]
         [,cookie64=on/off][,counter][,pincounter][,txcookie=txcookie]
         [,rxcookie=rxcookie][,offset=offset]
                configure a network backend with ID 'str' connected to
                an Ethernet over L2TPv3 pseudowire.
                Linux kernel 3.3+ as well as most routers can talk
                L2TPv3. This transport allows connecting a VM to a VM,
                VM to a router and even VM to Host. It is a nearly-universal
                standard (RFC3391). Note - this implementation uses static
                pre-configured tunnels (same as the Linux kernel).
                use 'src=' to specify source address
                use 'dst=' to specify destination address
                use 'udp=on' to specify udp encapsulation
                use 'srcport=' to specify source udp port
                use 'dstport=' to specify destination udp port
                use 'ipv6=on' to force v6
                L2TPv3 uses cookies to prevent misconfiguration as
                well as a weak security measure
                use 'rxcookie=0x012345678' to specify a rxcookie
                use 'txcookie=0x012345678' to specify a txcookie
                use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
                use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
                use 'pincounter=on' to work around broken counter handling in peer
                use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
                configure a network backend to connect to another network
                using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
                configure a network backend to connect to a multicast maddr and port
                use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
                configure a network backend to connect to another network
                using an UDP tunnel
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
                configure a vhost-user network, backed by a chardev 'dev'
-netdev hubport,id=str,hubid=n
                configure a hub port on QEMU VLAN 'n'
-net nic[,vlan=n][,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
                old way to create a new NIC and connect it to VLAN 'n'
                (use the '-device devtype,netdev=str' option if possible instead)
-net dump[,vlan=n][,file=f][,len=n]
                dump traffic on vlan 'n' to file 'f' (max n bytes per packet)
-net none       use it alone to have zero network devices. If no -net option
                is provided, the default is '-net nic -net user'
-net [user|tap|bridge|socket][,vlan=n][,option][,option][,...]
                old way to initialize a host network interface
                (use the -netdev option if possible instead)

Character device options:
-chardev null,id=id[,mux=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4][,ipv6][,nodelay][,reconnect=seconds]
         [,server][,nowait][,telnet][,reconnect=seconds][,mux=on|off] (tcp)
-chardev socket,id=id,path=path[,server][,nowait][,telnet][,reconnect=seconds][,mux=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
         [,localport=localport][,ipv4][,ipv6][,mux=on|off]
-chardev msmouse,id=id[,mux=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
         [,mux=on|off]
-chardev ringbuf,id=id[,size=size]
-chardev file,id=id,path=path[,mux=on|off]
-chardev pipe,id=id,path=path[,mux=on|off]
-chardev pty,id=id[,mux=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off]
-chardev braille,id=id[,mux=on|off]
-chardev serial,id=id,path=path[,mux=on|off]
-chardev tty,id=id,path=path[,mux=on|off]
-chardev parallel,id=id,path=path[,mux=on|off]
-chardev parport,id=id,path=path[,mux=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug]
-chardev spiceport,id=id,name=name[,debug=debug]

Device URL Syntax:
-iscsi [user=user][,password=password]
       [,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE
       [,initiator-name=initiator-iqn][,id=target-iqn]
       [,timeout=timeout]
                iSCSI session parameters
Bluetooth(R) options:
-bt hci,null    dumb bluetooth HCI - doesn't respond to commands
-bt hci,host[:id]
                use host's HCI with the given name
-bt hci[,vlan=n]
                emulate a standard HCI in virtual scatternet 'n'
-bt vhci[,vlan=n]
                add host computer to virtual scatternet 'n' using VHCI
-bt device:dev[,vlan=n]
                emulate a bluetooth device 'dev' in scatternet 'n'

TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
                use path to provide path to a character device; default is /dev/tpm0
                use cancel-path to provide path to TPM's cancel sysfs entry; if
                not provided it will be searched for in /sys/class/misc/tpm?/device

Linux/Multiboot boot specific:
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file    use 'file' as initial ram disk
-dtb    file    use 'file' as device tree image

Debug/Expert options:
-fw_cfg [name=]<name>,file=<file>
                add named fw_cfg entry from file
-fw_cfg [name=]<name>,string=<str>
                add named fw_cfg entry from string
-serial dev     redirect the serial port to char device 'dev'
-parallel dev   redirect the parallel port to char device 'dev'
-monitor dev    redirect the monitor to char device 'dev'
-qmp dev        like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,default]
-debugcon dev   redirect the debug console to char device 'dev'
-pidfile file   write PID to 'file'
-singlestep     always run in singlestep mode
-S              freeze CPU at startup (use 'c' to start execution)
-realtime [mlock=on|off]
                run qemu with realtime features
                mlock=on|off controls mlock support (default: on)
-gdb dev        wait for gdb connection on 'dev'
-s              shorthand for -gdb tcp::1234
-d item1,...    enable logging of specified items (use '-d help' for a list of log items)
-D logfile      output log to logfile (default stderr)
-L path         set the directory for the BIOS, VGA BIOS and keymaps
-bios file      set the filename for the BIOS
-enable-kvm     enable KVM full virtualization support
-xen-domid id   specify xen guest domain id
-xen-create     create domain using xen hypercalls, bypassing xend
                warning: should not be used when xend is in use
-xen-attach     attach to existing xen domain
                xend will use this when starting QEMU
-no-reboot      exit instead of rebooting
-no-shutdown    stop before shutdown
-loadvm [tag|id]
                start right away with a saved state (loadvm in monitor)
-daemonize      daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|date][,clock=host|rt|vm][,driftfix=none|slew]
                set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=no,rr=record|replay,rrfile=<filename>]
                enable virtual instruction counter with 2^N clock ticks per
                instruction, enable aligning the host and virtual clocks
                or disable real time cpu sleeping
-watchdog model
                enable virtual hardware watchdog [default=none]
-watchdog-action reset|shutdown|poweroff|pause|debug|none
                action when watchdog fires [default=reset]
-echr chr       set terminal escape character instead of ctrl-a
-virtioconsole c
                set virtio console
-show-cursor    show cursor
-tb-size n      set TB size
-incoming tcp:[host]:port[,to=maxport][,ipv4][,ipv6]
-incoming rdma:host:port[,ipv4][,ipv6]
-incoming unix:socketpath
                prepare for incoming migration, listen on
                specified protocol and socket address
-incoming fd:fd
-incoming exec:cmdline
                accept incoming migration on given file descriptor
                or from given external command
-incoming defer
                wait for the URI to be specified via migrate_incoming
-nodefaults     don't create default devices
-chroot dir     chroot to dir just before starting the VM
-runas user     change to user id user just before starting the VM
-sandbox <arg>  Enable seccomp mode 2 system call filter (default 'off').
-readconfig <file>
-writeconfig <file>
                read/write config file
-nodefconfig
                do not load default config files at startup
-no-user-config
                do not load user-provided config files at startup
-trace [events=<file>][,file=<file>]
                specify tracing options
-enable-fips    enable FIPS 140-2 compliance
-msg timestamp[=on|off]
                change the format of messages
                on|off controls leading timestamps (default:on)
-dump-vmstate <file>
                Output vmstate information in JSON format to file.
                Use the scripts/vmstate-static-checker.py file to
                check for possible regressions in migration code
                by comparing two such vmstate dumps.
Generic object creation
-object TYPENAME[,PROP1=VALUE1,...]
                create a new object of type TYPENAME setting properties
                in the order they are specified.  Note that the 'id'
                property must be set.  These objects are placed in the
                '/objects' path.

During emulation, the following keys are useful:
ctrl-alt-f      toggle full screen
ctrl-alt-n      switch to virtual console 'n'
ctrl-alt        toggle mouse and keyboard grab

When using -nographic, press 'ctrl-a h' to get some help.

Hey there,
I'm having issues implementing a connection type to my virtual machine. I'm not very familiar with Qemu ( I usually use vmware). What are the equivalent to NAT, bridged and host-only on qemu? How do you implemented them?

Chris

Check this
+https://www.qemu.org/2018/05/31/nic-parameter/

Hey there,
I'm having issues implementing a connection type to my virtual machine. I'm not very familiar with Qemu ( I usually use vmware). What are the equivalent to NAT, bridged and host-only on qemu? How do you implemented them?

Chris

You can see the virt-manager(libvirt tool) which usage is likes the vmware.

Hello.

I've installed ubuntu 20.04 on WSL2 and I started a VM with qemu and kvm,running mac os x as guest os. It works great,except for the configuration of the net. Infact it is not able to connect to internet. Sometime from WSL I get a 192.x.x.x ip number,like :

192.168.69.65 ; 192.168.71.185 ; 192.168.73.223 ; 192.168.69.33 ; 192.168.100.101

sometime I get a 172.x.x.x ip address,like : 172.22.250.54 ; 172.22.253.128 ; 172.21.138.120 ; 172.22.88.142.

The vEthernet (WSL) adapter on Windows 10 is configued like this : 172.26.80.1 as IP address,subnet mask = 255.255.240.0

I have created a bridge in WIndows 10,between my Intel ethernet adapter and the tap0 / Tap-windows. It's IP is 192.168.1.6 ; subnet mask = 255.255.255.0 ; gateway = 192.169.1.1 ; dns primary = 8.8.8.8

I have configured WSL like it is explained,but it didn't work. Check below what happens :

root@DESKTOP-N9UN2H3:/mnt/c/Android/sdk/platform-tools# brctl addbr br0
root@DESKTOP-N9UN2H3:/mnt/c/Android/sdk/platform-tools# ip addr flush dev eth0
root@DESKTOP-N9UN2H3:/mnt/c/Android/sdk/platform-tools# brctl addif br0 eth0

root@DESKTOP-N9UN2H3:/mnt/c/Android/sdk/platform-tools# tunctl -t tap0 -u root
Set 'tap0' persistent and owned by uid 0

root@DESKTOP-N9UN2H3:/mnt/c/Android/sdk/platform-tools# brctl addif br0 tap0
root@DESKTOP-N9UN2H3:/mnt/c/Android/sdk/platform-tools# ifconfig eth0 up
root@DESKTOP-N9UN2H3:/mnt/c/Android/sdk/platform-tools# ifconfig tap0 up
root@DESKTOP-N9UN2H3:/mnt/c/Android/sdk/platform-tools# ifconfig br0 up

root@DESKTOP-N9UN2H3:/mnt/c/Android/sdk/platform-tools# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.00155d99cfa4 no eth0
tap0

root@DESKTOP-N9UN2H3:/mnt/c/Android/sdk/platform-tools# dhclient -v br0

Internet Systems Consortium DHCP Client 4.4.1
Copyright 2004-2018 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/

Listening on LPF/br0/00:15:5d:99:cf:a4
Sending on LPF/br0/00:15:5d:99:cf:a4
Sending on Socket/fallback
DHCPDISCOVER on br0 to 255.255.255.255 port 67 interval 3 (xid=0xbbd3b615)
DHCPDISCOVER on br0 to 255.255.255.255 port 67 interval 8 (xid=0xbbd3b615)
DHCPDISCOVER on br0 to 255.255.255.255 port 67 interval 12 (xid=0xbbd3b615)
DHCPDISCOVER on br0 to 255.255.255.255 port 67 interval 11 (xid=0xbbd3b615)

root@DESKTOP-N9UN2H3:/mnt/c/Android/sdk/platform-tools# ifconfig

br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::215:5dff:fe99:cfa4 prefixlen 64 scopeid 0x20
ether 00:15:5d:99:cf:a4 txqueuelen 1000 (Ethernet)
RX packets 172 bytes 43127 (43.1 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 16 bytes 2304 (2.3 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether 00:15:5d:99:cf:a4 txqueuelen 1000 (Ethernet)
RX packets 543 bytes 121055 (121.0 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 28 bytes 3280 (3.2 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10
loop txqueuelen 1000 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

tap0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 46:88:cb:85:5f:9e txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

root@DESKTOP-N9UN2H3:/mnt/c/Android/sdk/platform-tools# ping www.google.it
ping: www.google.it: Name or service not known

I think IPv4 issue can be solved with configuring DHCP, but I don't know how to do that. I dont know why after removing address from eth0, which had an ipv4 address, and creating a bridge,it becomes no ipv4.

@nevilad

does not work on fedora 33, the vm has a weird ip address without internet access.
Anything special i need to do?

config

#BRIDGED NETWORKING
 brctl addbr br1
 ip addr flush dev eno1
 brctl addif br1 eno1
 tunctl -t tap0 -u `whoami`
 brctl addif br1 tap0
 ifconfig eno1 up
 ifconfig tap0 up
 ifconfig br1 up
 brctl show
 dhclient -v br1
 dhclient -v tap0
NET="-netdev tap,id=net0,ifname=tap0,script=no,downscript=no"
#NET="-netdev user,id=net0 -device rtl8139,netdev=net0"
#NET="-netdev tap,id=net0,ifname=tap0,netdev=net0"

#NDV="-device vmxnet3,netdev=net0,id=net0,mac=52:54:00:c9:18:27"
#NDV="-device rtl8139,netdev=net0,id=net0,mac=52:54:00:c9:18:27"
NVD= "-device e1000,netdev=net0,mac=52:54:00:c9:18:27"
#NDV= ""

extra=

# CD-ROM boot:
extra="-boot d"
extra="${extra} -drive file=Win10_20H2_EnglishInternational_x64.iso,media=cdrom"
#extra="${extra} -drive file=/home/swarren/shared/archive/Windows/virtio-win-0.1.126.iso,media=cdrom"

qemu-system-x86_64 \
    -enable-kvm \
    -m 12G \
    -machine q35,accel=kvm \
    -smp 16,cores=8 \
    -cpu Penryn,vendor=GenuineIntel,kvm=on,+sse3,+sse4.2,+aes,+xsave,+avx,+xsaveopt,+xsavec,+xgetbv1,+avx2,+bmi2,+smep,+bmi1,+fma,+movbe,+invtsc \
    -device isa-applesmc,osk="$OSK" \
    -smbios type=2 \
    -vga qxl \
    -device ich9-intel-hda -device hda-output \
    -usb -device usb-kbd -device usb-mouse \
    $NET \
    $NDV \
    -device ich9-ahci,id=sata \
    -drive id=SystemDisk,if=none,file=MyDisk.qcow2 \
    -device ide-hd,bus=sata.4,drive=SystemDisk \
    -device pcie-root-port,bus=pcie.0,multifunction=on,port=1,chassis=1,id=port.1 \
    -device vfio-pci,host=28:00.0,bus=port.1,multifunction=on,romfile=./Gigabyte.RX5708GB.8192.180505.rom \
    -device vfio-pci,host=28:00.1,bus=port.1 \
    $extra

output

Set 'tap0' persistent and owned by uid 0
bridge name	bridge id		STP enabled	interfaces
br1		8000.ba6486f33778	no		eno1
							tap0
virbr0		8000.5254009de47c	yes		virbr0-nic
Internet Systems Consortium DHCP Client 4.4.2b1
Copyright 2004-2019 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/

Listening on LPF/br1/ba:64:86:f3:37:78
Sending on   LPF/br1/ba:64:86:f3:37:78
Sending on   Socket/fallback
DHCPREQUEST for 192.168.1.167 on br1 to 255.255.255.255 port 67 (xid=0xb6f59c41)
DHCPACK of 192.168.1.167 from 192.168.1.1 (xid=0xb6f59c41)
bound to 192.168.1.167 -- renewal in 6243 seconds.
dhclient(4522) is already running - exiting. 

@CristianPi You can try with user mode emulation which doesn't require a tap to be setup. Also would recommend to use virt-manager to set up the VM's which would take care of setting the correct options.

ifconfig, tunctl and brctl are mostly considered deprecated nowadays and may not be easily available on newer installations. For reference I cobbled together a similar (but untested) list of commands using iproute2:

Setup

ip link add name br0 type bridge
ip addr flush dev eth0
ip link set eth0 master br0
ip tuntap add tap0 mode tap
ip link set tap0 master br0
ip link set up dev eth0
ip link set up dev tap0
ip link set up dev br0
dhclient -v br0

Cleanup

ip link set tap0 nomaster
ip tuntap del tap0
ip link set eth0 nomaster
ip link set down dev br0
ip link del br0
ip link set up dev eth0
dhclient -v eth0

I try to use your script suggested @aarav2you , but does not work for me. I guess that is because my laptop only uses the wifi card.

I have written the following script to set it up, please change the interface as according to yours. You need dhclient and iproute2

#!/bin/bash

if [[ $EUID > 0 ]]
  then echo "Run this script as root"
  exit
fi

BRIDGE="br0"
TAP="tap0"
INTERFACE="enp7s0"

echo "Adding bridge $BRIDGE"
ip link add name $BRIDGE type bridge

echo "Flushing interface $INTERFACE"
ip addr flush dev $INTERFACE

echo "Setting $BRIDGE as master of $INTERFACE"
ip link set $INTERFACE master $BRIDGE

echo "Adding tap $TAP"
ip tuntap add $TAP mode tap

echo "Setting $BRIDGE as master of $TAP"
ip link set $TAP master $BRIDGE

echo "Setting $INTERFACE, $BRIDGE and $TAP up"
ip link set up dev $INTERFACE
ip link set up dev $TAP
ip link set up dev $BRIDGE

echo "Stopping NetworkManager"
systemctl stop NetworkManager

echo "Requesting ip for $BRIDGE"
dhclient $BRIDGE

if [ $? -eq 0 ]; then
    echo "Requesting ip for $INTERFACE"
    dhclient $INTERFACE
    echo "Killing dhclient and starting NetworkManager"
    pkill -9 dhclient
    systemctl start NetworkManager
fi

doesn't work for me

Assuming you want to run vm on your laptop and that has only wifi supported.
May be mixed bridge + dhcp server + iptable are well for that(oh! it is the nat mode).

1. create the bridge(br0) on the host and enables it.
2. install and run dhcp server.
3. set the traffic get through the wireless
4. setup tap device for vm with qemu cmd and connect to the bridge(br0)

e.g.

1. network setup on the host

> cat nat.sh
#!/bin/bash
BRIDGE=br0
WIRELESS=wifi0
NETWORK=10.10.10.0
NETMASK=255.255.255.0
GATEWAY=10.10.10.1
DHCPRANGE=10.10.10.100,10.10.10.254

ip link add $BRIDGE type bridge
ip link set dev $BRIDGE up
ip addr add dev $BRIDGE $GATEWAY/$NETMASK

sysctl -w net.ipv4.ip_forward=1 > /dev/null 2>&1

iptables --flush
iptables -t nat -F
iptables -X
iptables -Z
#iptables -P PREROUTING ACCEPT
#iptables -P POSTROUTING ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i $BRIDGE -p tcp -m tcp --dport 67 -j ACCEPT
iptables -A INPUT -i $BRIDGE -p udp -m udp --dport 67 -j ACCEPT
iptables -A INPUT -i $BRIDGE -p tcp -m tcp --dport 53 -j ACCEPT
iptables -A INPUT -i $BRIDGE -p udp -m udp --dport 53 -j ACCEPT
iptables -A FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT
iptables -A FORWARD -s $NETWORK/$NETMASK -i $BRIDGE -j ACCEPT
iptables -A FORWARD -d $NETWORK/$NETMASK -o $BRIDGE -m state --state RELATED,ESTABLISHED -j ACCEPT
# make a distinction between the bridge packets and routed packets, don't want the
# bridged frames/packets to be masqueraded.
iptables -t nat -A POSTROUTING -s $NETWORK/$NETMASK -d $NETWORK/$NETMASK -j ACCEPT
iptables -t nat -A POSTROUTING -s $NETWORK/$NETMASK -j MASQUERADE

dns_cmd=(
    dnsmasq
    --strict-order
    --except-interface=lo
    --interface=$BRIDGE
    --listen-address=$GATEWAY
    --bind-interfaces
    --dhcp-range=$DHCPRANGE
    --conf-file=""
    --pid-file=/var/run/qemu-dnsmasq-$BRIDGE.pid
    --dhcp-leasefile=/var/run/qemu-dnsmasq-$BRIDGE.leases
    --dhcp-no-override
)

echo ${dns_cmd[@]} | bash

# set the traffic get through the wireless
iptables -A FORWARD -i $BRIDGE -o $WIRELESS -j ACCEPT
iptables -t nat -A POSTROUTING -o $WIRELESS -j MASQUERADE
# let the known traffic get back at bridge
iptables -A FORWARD -i $WIRELESS -o $BRIDGE -m state --state RELATED,ESTABLISHED -j ACCEPT

2. install tap device by qemu cmd

    -device e1000,netdev=network0,mac=$(nicmac)
    -netdev tap,id=network0,ifname=${tapid},vhostforce=on,script=${upscript},downscript=${downscript}

   # nicmac: the virtual nic mac address
   # tapid: the virtual nic name on the host
   # upscript/downscript: the scripts handle the network  status for that virtual nic device

3. start your vm

I have written the following script to set it up, please change the interface as according to yours. You need dhclient and iproute2我已经编写了以下脚本来设置它，请根据您的界面更改界面。您需要 dhclient 和 iproute2

#!/bin/bash

if [[ $EUID > 0 ]]
  then echo "Run this script as root"
  exit
fi

BRIDGE="br0"
TAP="tap0"
INTERFACE="enp7s0"

echo "Adding bridge $BRIDGE"
ip link add name $BRIDGE type bridge

echo "Flushing interface $INTERFACE"
ip addr flush dev $INTERFACE

echo "Setting $BRIDGE as master of $INTERFACE"
ip link set $INTERFACE master $BRIDGE

echo "Adding tap $TAP"
ip tuntap add $TAP mode tap

echo "Setting $BRIDGE as master of $TAP"
ip link set $TAP master $BRIDGE

echo "Setting $INTERFACE, $BRIDGE and $TAP up"
ip link set up dev $INTERFACE
ip link set up dev $TAP
ip link set up dev $BRIDGE

echo "Stopping NetworkManager"
systemctl stop NetworkManager

echo "Requesting ip for $BRIDGE"
dhclient $BRIDGE

if [ $? -eq 0 ]; then
    echo "Requesting ip for $INTERFACE"
    dhclient $INTERFACE
    echo "Killing dhclient and starting NetworkManager"
    pkill -9 dhclient
    systemctl start NetworkManager
fi

thanks a lot