Summary
Enable guest virtual machines to share a physical network interface (NIC) with other guests and the host operating system. This allows guests to independently appear on the same network as the host machine.
Owner
- Name: David Lutterkort
Current status
- Targeted release: Fedora 11
- Last updated: 2009-01-27
- Percentage of completion: 5%
TODO
- NetworkManager support
- libvirt implementation of XML format and API.
- UI in virt-manager for configuring a shared interface.
Completed
- Initial discussion on libvir-list on the XML format, API and implementation options.
Detailed Description
Background
Guest virtual machines usually need access to the network.
In Fedora we currently provide network access via a libvirt Virtual Network which is designed to always be available. This acts like a home broadband router, in that it NATs the traffic over any connected network interface.
A virtual network is the most suitable network access method to use for guests by default. It works well for laptop users because as you e.g. switch between wireless networks, the virtual network continues to be usable. It also allows inter-guest and guest-host communication even when the host machine is not connected to any network.
However, virtual networks also have a major disadvantage. Because traffic is NATed, the guest is not accessible to external hosts without configuring DNAT rules to forward connections to a specific host port onto the guest.
An alternate approach is to create a bridge, add a physical network device to the bridge and configure the bridge statically or using dhcp. At this point, the bridge appears to the host just like the physical interface.
Once the bridge has been configured, guest machines which are added to the bridge share the physical device and are effectively connected to the same physical network as the host machine. Thus, guest machines can be configured like any physical machine on the network and are directly accessible from other machines on the network.
Implementation
The first thing required is for NetworkManager to support this configuration. It must be possible for NetworkManager to be configured so that it will create a bridge, update iptables, add the physical interface and configure the bridge.
Next, a new API and XML format will be added to libvirt for managing host network interfaces. This will support not only the bridging configuration described here, but also other common network interface configurations.
The libvirt implementation must be capable of working with either NetworkManager or standard initscripts, depending on how the machine is configured.
A very welcome side-effect of this new API in libvirt is that it will be possible to configure network interfaces remotely. This builds upon existing remote virtualization management features like secure remote management, secure remote console access, remote guest installation and remote storage management.
Finally, a UI will be added to virt-manager to allow users to configure given physical network interfaces as shared. A UI already exists to user shared interfaces for guest network connectivity.
Benefit to Fedora
This shared network interface configuration is a very common configuration in virtualization.
Xen supported this with a hacky /etc/xen/scripts/network-bridge which was universally despised.
The current recommended way to set this up in Fedora involves disabling NetworkManager, manually editing network initscript configuration and adding iptables rules. This is not ideal, and the new method will be far superior.
Scope
As described above, changes are required in at least NetworkManager, libvirt and virt-manager.
How To Test
- Run virt-manager and click on "New" to begin installing a guest
- On the "Connect to host network" screen, choose a shared physical interface from the list
- Click on "Finish" to being installing the guest
- Observe (e.g. using
brctl) that a bridge has been configured - Verify that the guest has successfully connected to the network
User Experience
See the previous section.
Dependencies
None, outside of the implementation efforts detailed above.
Contingency Plan
If the NetworkManager implementation is not ready, we may still provide the libvirt initscripts backend. In order to use this, people would have to disable NetworkManager. That is still an improvement on the current situation, though.
If the libvirt side is not ready, but the NetworkManager bits are then at least we can stop telling people to disable NetworkManager. There probably wouldn't be any virt-manager UI, though.
Documentation
- libvirt Networking wiki page
- libvirt proposal
- NetworkManager feature request
- Out of date design writeup
Release Notes
Fedora 11 adds the ability to configure shared network interfaces for improved virtual machine connectivity. This enables virtual machines to be bridged directly to same the physical network as the host machine.