libvirt Isolated and Routed Networks (KVM)

libvirt ships with one NAT network, but you can define more. Isolated networks keep backend traffic private between VMs, and routed networks hand out extra public IPs without NAT. This guide shows how to create libvirt isolated and routed networks.

Before you start

A KVM host with libvirt; see install KVM on Ubuntu.
Background on modes: bridges, NAT and VLANs.

Network modes in libvirt

Mode	Behaviour
nat	Private subnet, outbound internet via host masquerading (the default network)
isolated (no forward)	VMs and host can talk; no route to outside
route	Host routes a subnet to VMs without NAT
bridge	Uses an existing host bridge such as br0

Create an isolated network

Save as backend.xml:

<network>
  <name>backend</name>
  <bridge name='virbr10'/>
  <ip address='10.20.0.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='10.20.0.100' end='10.20.0.200'/>
    </dhcp>
  </ip>
</network>

No <forward> element means isolated. Define and start:

virsh net-define backend.xml && virsh net-start backend && virsh net-autostart backend

Use it for database traffic between web and DB VMs.

Create a routed network

When the provider routes a subnet (e.g. 198.51.100.0/28) to your host's main IP:

<network>
  <name>public-routed</name>
  <forward mode='route' dev='eno1'/>
  <bridge name='virbr20'/>
  <ip address='198.51.100.1' netmask='255.255.255.240'/>
</network>

VMs use addresses from the subnet with gateway 198.51.100.1 (the host). IP forwarding is enabled by libvirt for routed networks; make sure your own firewall rules allow forwarding.

Static DHCP leases

virsh net-update backend add ip-dhcp-host "<host mac='52:54:00:11:22:33' name='db01' ip='10.20.0.10'/>" --live --config

Attach VMs

New VM: virt-install ... --network network=backend,model=virtio.
Existing VM: virsh attach-interface db01 network backend --model virtio --persistent.

A VM can have several NICs, e.g. one public and one on the isolated backend.

Troubleshooting

Network fails to start: subnet conflicts with a host interface or another network.
Routed VMs unreachable: the provider has not routed the subnet to your host, or a host firewall drops forwarded traffic.
No DHCP: dnsmasq for that network failed; check journalctl for libvirt errors.

Frequently asked questions

Can isolated VMs reach the internet?

No, by design. Give them a second NAT NIC or a proxy if they need updates.

Routed or bridged for public IPs?

Routed avoids MAC filtering problems at many providers; bridged is simpler when the provider allows extra MACs.

Can I add VLANs to libvirt networks?

Yes, with Open vSwitch portgroups or VLAN-aware host bridges; see Open vSwitch with KVM.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket