KVM with bridge

In the following, I will describe how to set up kvm in an environment where you want the guest virtual machines to appear as independent servers, indistinguishable from the ordinary metal boxes sitting on the floor of the office.

Host Configuration

The server, called ‘'’octopus’’’, is a powerful HP 380 G5 machine, with an Intel dual quadcore CPU. This is a processor that has hardware virtualization enabled, which you can see by doing:

egrep ‘(vmx|svm)’ /proc/cpuinfo

If you get output from this command, your processor has either vmx (Intel) or svm (AMD) capability. If not, you can give up running qemu right here. It will be s.l.o.w. In our case, the server is pretty damn fast. It has the equivalent of 8 CPU’s and is equipped with 12Gb RAM. We intend to run 8 guest servers on it, all for a particular task, e.g. web server, name server, etc.

I started out with a fresh installed Ubuntu Server, version 7.10, “Gutsy Gibbon”.

Installing kvm and qemu

First, install kvm and qemu:

octopus# install kvm qemu
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
  bochsbios bridge-utils vgabios
Suggested packages:
  kvm-source debto debootstrap etherboot
Recommended packages:
  vde2 sharutils proll openhackware
The following NEW packages will be installed:
  bochsbios bridge-utils kvm qemu vgabios
0 upgraded, 5 newly installed, 0 to remove and 0 not upgraded.
Need to get 4788kB of archives.
After unpacking 13.1MB of additional disk space will be used.
Do you want to continue [Y/n]? y

As you see from the above, kvm pulls in a number of other packages that are needed. In particular, the bridge-util package is important. The very first thing to do is to make the host ‘'’octopus’’’ function as a network bridge, that accepts network traffic that arrives on the guest’s IP address, and relays it to the guest’s virtual network interface.

Load kernel module

Next, we need to load a kvm kernel module:

modprobe kvm-intel

or “kvm-amd” if that is your hardware platform. ‘‘(In 8.04 (Hardy) you can skip this step, since the kvm module is loaded automatically.)’’

That command inserts the module in the currently running kernel. However, to have it loaded at each boot, insert the module name (kvm-intel/kvm-amd) in the file /etc/modules.

Define the bridge interface

Edit the file /etc/network/interface, which on an Ubuntu or Debian system contains information for configuration of the network interface. This is what the file looked like before editing:

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
        address 192.168.0.101
        netmask 255.255.255.0
        network 192.168.0.0
        broadcast 192.168.0.255
        gateway 192.168.0.1
        # dns-* options are implemented by the resolvconf package, if installed
        dns-nameservers 192.168.0.4
        dns-search mydomain.net

We edit the file, so it gets the following content:

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto br0
iface br0 inet static
        address 192.168.0.101
        netmask 255.255.255.0
        network 192.168.0.0
        broadcast 192.168.0.255
        gateway 192.168.0.1
        bridge_ports eth0
        bridge_stp off
        bridge_maxwait 5
        # dns-* options are implemented by the resolvconf package, if installed
        dns-nameservers 192.168.0.4
        dns-search mydomain.net

We see that the internet address of ‘'’octopus’’’ is now assigned to the br0 interface, and the original eth0 is defined tied to the bridge via the bridge_prots keyword. If your primary network interface is eth1, for example, you need to use that name.

Bring Up Bridge

Either reboot, or cycle the interfaces if the machine is local:

sudo ifup br0

Check the host

Once the server comes back up, you should test that it still has proper network connections, on both sides of the gateway, f.ex. using ping.

Now, check the network interfaces using the ip addr command. Notice in the following listing, that eth0 no longer has an associated IP address, while the new bridge device br0 has taken over the IP address.

octopus# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:1c:c4:5e:18:5e brd ff:ff:ff:ff:ff:ff
    inet6 fe80::21c:c4ff:fe5e:185e/64 scope link
       valid_lft forever preferred_lft forever
3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:1c:c4:5e:18:5e brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.101/24 brd 192.168.0.255 scope global eth0
    inet6 fe80::21c:c4ff:fe5e:185e/64 scope link
       valid_lft forever preferred_lft forever

libvirt Guest Configuration

In virt-manager, a “bridge” configuration is now selectable when creating a new VM. To modify existing VMs, you can change the XML definition (in /etc/libvirt/qemu for the network interface, adjusting the mac address as desired:

<interface type='bridge'>
  <mac address='00:11:22:33:44:55'/>
  <source bridge='br0'/>
</interface>

Finally, restart libvirtd (make sure your VMs are shutdown):

sudo /etc/init.d/libvirtd restart

KVM-only Guest Configuration

We have a new device called tap0:

tap0      Link encap:Ethernet  HWaddr 00:FF:F9:C5:39:4A
          inet6 addr: fe80::2ff:f9ff:fec5:394a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2492 errors:0 dropped:0 overruns:0 frame:0
          TX packets:88109 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500
          RX bytes:279707 (273.1 KB)  TX bytes:11379233 (10.8 MB)

Start the virtual machine

At this point, I assume that you already have access to a virtual server machine. How to create it is described elsewhere. On octopus, the virtual server ‘'’octo1’’’ is a 5G file stored on the /home partition, and based on the Ubuntu JeOS server.

We now start the virtual machine:

octopus# kvm -m 512 -net nic -net tap  /home/octopus-jeos.img

kvm will now boot the virtual machine in an X window. You will se the normal boot sequence inside the window. Eventually, the virtual machine comes up, and you should be able to log on. ‘‘Beware that kvm’s window takes control of your mouse, so the system seems completely unresponsive!’’ You need to press and simultaneously for kvm to release the mouse.

Configure the guest machine

Now is the time to configure the guest machine, in this case octo1. Notice that you should configure the guest machine exactly like you would configure a normal box sitting under your desk. In our case, the network on octo1 is set up, again in the file /etc/network/interface, which on octo1 looks like this:

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
#iface eth0 inet dhcp
iface eth0 inet static
        address 192.168.0.102
        netmask 255.255.255.0
        network 192.168.0.0
        broadcast 192.168.0.255
        gateway 192.168.0.1
        dns-nameservers 192.168.0.4
        dns-search mydomain.net

That’s it! The guest machine (you may have to reboot it) should now have access to the internet, and you should be able to reach it from the outside. You can now configure it further.

When you are done with the configuration, you will likely want to start up the virtual machine as a standalone process without a graphics console. That can be achieved using the -daemonize and -nographic options:

kvm -m 512 -net nic -net tap -daemonize -nographic /home/octopus-jeos.img

Several virtual machines on the same host

Soon, you will want to have several virtual machines running on the same server. Of course, each guest must have its own unique IP address, but in addition, you need to make sure that each virtual machine also has a unique mac-address. The network card in your computer has a hardwired mac-address, but of course this is not so with a virtual machine.

The mac-address consists of six bytes, usually given in hexadecimal code. Normally, it encodes the vendor and a serial number. However, you can make your own mac addresses which can be any number as long as the first byte is 02. This is a so-called ‘‘locally administered address’’.

octopus# kvm -m 512 -net nic,macaddr=02:00:00:00:00:01 -net tap  /home/octopus-jeos.img

If you have been using the virtual machine before, you will need to edit it’s network configuration again, because the first time you invoke kvm with the macaddr option, it creates a new network device having the given mac address. That may be for example eth1, and so you will have to reconfigure that device with the correct IP address etc.


This post was originally authored for the Ubuntu Wiki, reformatted for inclusion in this blog 2015-05-15.


How to use ssh authentication keys

If you have an account on a remote computer that you use very often, it is convienient if you do not have to type your password every time you log on to another host. You can achieve this by using ssh’s authorization keys.

First, you need to generate a key-pair. A key-pair consists of two small files. One file contains your secret key, the other your public key. Your secret key is, as the name implies, secret. You want to make sure noone gets hold of it. The public key is not secret at all, you can post it on your web-page if you wish. To generate the keypair, use the ssh-keygen program:

[somebody@monster ~]$ ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (/u/somebody/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /u/somebody/.ssh/id_rsa.
Your public key has been saved in /u/somebody/.ssh/id_rsa.pub.
The key fingerprint is:
5a:0c:9d:c8:2b:aa:4d:1c:db:3e:ca:e2:1e:43:27:3c
somebody@monster.bioxray.dk

Notice, I did not enter a passphrase. The passphrase is an optional password that protects your secret key. It is a password you have to type every time your secret key is used, but your security is only compromised if someone gets hold of your secret key, so you must protect that file using mode 600. Now, the two files have been created in $HOME/.ssh:

[somebody@monster ~]$ ls .ssh
authorized_keys id_rsa id_rsa.pub known_hosts

To achieve login on a remote machine without password, you need to append your public key to the .ssh/authorized_keys file on the remote machine. That is, if you specified a passphrase for your key-pair, you have to type that when you log on, but not the password on the remote machine.

On bioxray, all users have NFS mounted home directories, so we can just do this:

cp .ssh/id_dsa.pub .ssh/authorized_keys

and we can use slogin and ssh between all hosts without specifying a password.

You can also use the ssh authentication key scheme to give access to your account to a friend. Your friend must also generate a key-pair, and must send you the public part of it. You append that public key to your authorized_keys file. Your friend can then log on to your account, as long as the public key is in the file.

If you have an account on a remote computer that you use very often, it is convienient if you do not have to type your password every time you log on to another host. You can achieve this by using ssh’s authorization keys.

Edit 20170123

  • Changed key type from rsa to dsa 4096 bits. For further information look here.
  • Add note about passwordless secret key.