KVM Bridge and NAT
Aug 15, 2016

I ran into an interesting problem to solve. I have multiple VMs using KVM that do not require inbound IPv4 but do require at least IPv6 inbound (for CloudFlare) and it would be nice to have outbound IPv4.

I already have a bridge setup for IPv4 + IPv6 named br0 but need a separate bridge just for NAT routing for special VMs that do not require public IPv4 addresses.

  1. A second NIC needs to be added. This one will use the default network.

    • ```
1. Stop all VMs you modified and restart libvirtd.

   - `systemctl restart libvirtd.service`

1. Set the default network to auto start.

   - ```
virsh net-autostart default
virsh net-start default
  • By default the bridge IP is This is the subnet we’ll use in the VMs.

    • 13: virbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
       link/ether fe:54:00:9d:ef:df brd ff:ff:ff:ff:ff:ff
       inet brd scope global virbr0
        valid_lft forever preferred_lft forever
  1. Forwarding must be allowed in iptables and sysctl. Remember that br0 is the original bridge I set up for public IPv4 + IPv6. The bridge that gets created by libvirt (virbr0) is for the internal IPv4 network.

    • iptables -t nat -A POSTROUTING -s -o br0 -j MASQUERADE
      sysctl -w net.ipv4.ip_forward=1
      sysctl -w net.ipv6.conf.all.forwarding=1
  2. Start the VMs back up.

  3. Make sure you now have a new interface named eth1. Edit the interfaces file in the VM:

    • auto eth1
      iface eth1 inet static
  4. Reboot the VM and you should be good to go.