Virtual networking for VMs: bridges, NAT and VLANs

Every VM has a virtual network card, but how that card reaches the outside world depends on the host's virtual networking setup. The main options are bridging, NAT, routing and VLANs. Picking the right one decides whether your VMs get public IPs, stay private or are separated into networks.

Before you start

• A KVM host such as one built with install KVM on Ubuntu.
• Console access: network changes can cut your SSH session.

Bridged networking

A Linux bridge works like a virtual switch. The host's physical NIC and each VM's tap interface join the bridge, so VMs appear directly on the physical network.

• Use when VMs need public IPs routed to the server's segment.
• Typical names: br0, or vmbr0 in Proxmox VE.
• Many data centres only accept known MAC addresses; you may need virtual MACs from the provider or a routed setup.

NAT networking

libvirt's default network (virbr0, 192.168.122.0/24) gives VMs private addresses through DHCP and masquerades their traffic behind the host IP.

• Simple and works anywhere.
• VMs are not reachable from outside unless you add port forwards (iptables/nftables DNAT).
• Good for labs, build machines and internal services.

Routed networking

The host acts as a router: an extra subnet is routed to the host's main IP, and the host forwards it to VMs on an internal bridge. This avoids MAC filtering problems and is common at providers like Hetzner. Enable forwarding with:

sysctl -w net.ipv4.ip_forward=1

and persist it in /etc/sysctl.d/. The same applies to IPv6; see IPv6 setup.

VLANs

VLANs (802.1Q) split one physical link into isolated networks by tagging frames. On a VLAN-aware bridge you can put each VM on its own VLAN. In Netplan:

vlans:
  vlan100:
    id: 100
    link: eno1
bridges:
  br100:
    interfaces: [vlan100]

The upstream switch port must be a trunk carrying those VLANs. Proxmox makes this simpler with a VLAN aware checkbox on vmbr0 and a VLAN tag per VM NIC.

Open vSwitch

Open vSwitch is an advanced virtual switch with OpenFlow, tunnels (VXLAN, GRE) and detailed traffic control, used in large clouds and SDN setups. For a single host a Linux bridge is usually enough.

Which mode to choose

Troubleshooting

• VM gets no traffic on a bridge: check the provider's MAC filtering and that br_netfilter rules are not dropping packets.
• NAT VMs cannot reach the internet: confirm IP forwarding and that your firewall did not flush libvirt's rules.
• VLAN traffic missing: the switch port is not a trunk, or the VLAN ID differs.

Frequently asked questions

Can a VPS customer change these settings?

No, they are host-level. Inside a VPS you only configure your own interface.

Bridge or macvtap?

macvtap is simpler but the host cannot talk to its own VMs by default. Bridges are more flexible.

Does NAT slow VMs down?

Slightly, through connection tracking, but rarely noticeably.

Next steps

• Static IP with Netplan
• VirtFusion hypervisor networking
• VPS with no network