The bridge interface device is a virtual network switch. Physical switch has ports that we connect machines to (with cables). Managed network switch has IP address, so we can connect to it in order to manage it.
The default install of libvirt on AlmaLinux does include one virtual network (with name “default”). That network is a bridge interface that is created during service startup. Host gets IP address on the bridge (just like managed switch has an address). Host provides DHCP and DNS (with ‘dnsmasq’) for the network. When we create VM that has interface on that network, we automatically add a port to the bridge interface (vnetN) and virtual cable from that port to the NIC of the VM. The VM should get network config from the DHCP.
The network “virbr” (represented by the bridge interface) is separate from the physical network “LAN” that is outside the host. There are three options:
- Isolated. The LAN and virbr stay separate
- Routed. The host acts as router that passes traffic between LAN and virbr
- Routed, with NAT. Like routed, but host masquerades traffic that comes from virbr to LAN, i.e. members of LAN do not know that virbr exists
The “default” network is routed with NAT.
It is possible to add a physical NIC of the host as a port of a bridge interface. The cable that comes from outside, from physical switch, to that NIC will effectively connect two network switches (physical and bridge), expanding the LAN. Any VM that you connect to such bridge will be member of the LAN – the host will not need to route traffic such VM and outsiders. This is the “bridged” setup.
The NIC of the host should have no IP address, because it is merely one port of the virtual network switch (the bridge). Host may have IP address on the bridge.
If the host has more than one NIC, then one (with no IP address) could be used as port of the bridge. The host will not need IP address on the bridge, as it uses other NICs for its own communication; the bridge will be like unmanaged switch. The libvirt can create such bridge on service startup.
If the host has only one NIC, then one should create bridge on the host’s NetworkManager config. That way it will start on boot (i.e. the host will have IP address) whether you start libvirt or not.
The man nmcli-examples does kind of show that.
nmcli con add type bridge con-name TowerBridge ifname TowerBridge bridge.stp no
nmcli con add type ethernet con-name br-port-1 ifname ens3 controller TowerBridge
This assumes that name of NIC is ‘ens3’ and that machine gets IP config from DHCP.
Since the machine probably does have network configured already – NM connection for ‘ens3’, that other connection has to be removed.
The Chapter 18. Configuring network settings by using RHEL system roles | Automating system administration by using RHEL system roles | Red Hat Enterprise Linux | 9 | Red Hat Documentation shows how to use Ansible System Roles to do the same config.
For that one needs dnf install ansible-core rhel-system-roles
The config below is basically same as the nmcli commands above, but here the NIC is matched by its MAC address (A0:B1:C2:D3:E4:F6), rather than by name (ens3).
network_connections:
- name: TowerBridge
interface_name: TowerBridge
type: bridge
ip:
dhcp4: true
auto6: true
ethtool:
features: {}
state: up
- name: br-port-1
type: ethernet
autoconnect: yes
mac: A0:B1:C2:D3:E4:F6
controller: TowerBridge
port_type: bridge
state: up
The obvious tricky part is that one has to remove the IP address (on “ens3”) of the host and add it to the bridge. If you do not have console access to the server, i.e. you manage it over network (with ssh, etc), then that really does require correct set of commands. If you do have console (monitor and keyboard), then small mistakes can be corrected.