No internet connection in VM with Libvirt NAT

Question

Hello super users,

I am trying to get an internet connection up and running in my KVM/QEMU VM through Libvirt's default NAT.

Unfortunately, the guest (Windows 10) sees the virtual adapter as an "Unidentified network" and shows that there is "No Internet". This and the output of "ipconfig" (below) shows that the VM's DHCP does not work properly. The subnet mask (originally 255.255.255.0) and the auto IPv4 (, which should be between 192.168.122.2 and 192.168.122.254,) are misconfigured as well:

Ethernet adapter Ethernet 2:
   Connection-specific DNS Suffix  . :
   Autoconfiguration IPv4 Address. . : 169.254.81.241
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :

Output of "ip a" on the host while the VM is running:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether f0:2f:74:1b:5b:aa brd ff:ff:ff:ff:ff:ff
3: virbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 52:54:00:5b:92:9a brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
4: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether d0:37:45:d8:fb:9a brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.127/24 metric 20 brd 192.168.0.255 scope global dynamic wlan0
       valid_lft 603733sec preferred_lft 603733sec
    inet6 fe80::d237:45ff:fed8:fb9a/64 scope link
       valid_lft forever preferred_lft forever
6: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master virbr0 state UNKNOWN group default qlen 1000
    link/ether fe:54:00:d4:cd:4e brd ff:ff:ff:ff:ff:ff
    inet6 fe80::fc54:ff:fed4:cd4e/64 scope link
       valid_lft forever preferred_lft forever

Output of "ip r" on host:

default via 192.168.0.1 dev wlan0 proto dhcp src 192.168.0.127 metric 20
192.168.0.0/24 dev wlan0 proto kernel scope link src 192.168.0.127 metric 20
192.168.0.1 dev wlan0 proto dhcp scope link src 192.168.0.127 metric 20
192.168.0.56 dev wlan0 proto dhcp scope link src 192.168.0.127 metric 20
192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1

This is weird, because the bridge (virbr0) is up and the virtual interface (vnet0) is attached to it. To fix the misconfiguration, I set the LAN settings statically, which worked, but now I can only ping my host (192.168.0.127) and the bridge (192.168.122.1), but pings to WAN servers like "google.com" or even "8.8.8.8" time out. Doesn't this mean that virbr0 works and forwards the packets as expected, however the firewall does not allow the virtual bridge to send packets to the default gateway?

nftables rules (# nft list ruleset): http://0x0.st/Ho6G.txt
virbr0 config (/etc/libvirt/qemu/networks/default.xml): http://0x0.st/Ho6h.txt
Libvirt log (/var/log/libvirt/libvirtd.log): http://0x0.st/Ho6n.txt
vnet0 config while VM is on (/etc/libvirt/qemu/win10.xml): http://0x0.st/HoIs.txt

This is what I have already tried:

Installing and enabling dnsmasq (the dnsmasq errors are gone now)
sysctl -w net.ipv4.ip_forward=1 >> /etc/sysctl.conf

Thank you in advance for your time and help!

limefrog :)))

Stuart Cardall · Answer 1 · 2024-10-03T17:27:59.353

libvirt does not work well with nftables yet

install the iptables compatibility package for nftables (iptables-nft)
edit /etc/libvirt/network.conf & set the backend to iptables

firewall_backend = "iptables"

from the virsh console:

net-destroy default
net-start default

libvirt will then create the firewall rules for nat to work:

[root@endeavour ~]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

LIBVIRT_PRT  all  --  anywhere             anywhere
Chain LIBVIRT_PRT (1 references)
target     prot opt source               destination

RETURN     all  --  192.168.122.0/24     base-address.mcast.net/24 
RETURN     all  --  192.168.122.0/24     255.255.255.255

MASQUERADE  tcp  --  192.168.122.0/24    !192.168.122.0/24     masq ports: 1024-65535
MASQUERADE  udp  --  192.168.122.0/24    !192.168.122.0/24     masq ports: 1024-65535
MASQUERADE  all  --  192.168.122.0/24    !192.168.122.0/24

No internet connection in VM with Libvirt NAT

1 Answers1