Re: [Qemu-discuss] Multiple VM's on Multiple VLANS

[Mike Lovell]

On 10/30/2012 11:15 AM, Brian Doyle wrote:
> Hello all,
>
> I am trying to setup multiple VM's utilizing multiple VLANS.  My basic 
> setup works using a single bridge on the host but this bridge is 
> allowing DHCP requests to get through to my VM with a DHCP server 
> running.
>
> Here is a "map" of what I am trying
>
> VM1 -> 192.168.1.# -> tap0 & -> 172.16.0.# -> tap1
>  |
>
>  |
> VM2-> 172.16.0.# -> tap2  & -> 10.0.0.# -> tap3
>  |
>  |
> VM3 -> 10.0.0.# -> tap4
>
>
> VM3 is a thin client PXE boot setup connecting to VM2.  VM2 is allowed 
> access through to the real world via VM1.

i assume that all of the tap devices are connected to the single bridge 
on the host that you said you had and that it is a standard kernel 
bridge. if that is the case, then all of those devices are connected to 
the same broadcast domain. i am also guessing that you put a different 
'vlan=X' option on each qemu process. if this is what you did, its not 
correct for what you want and a very common mistake.

in the qemu network options, a 'vlan' is *not* a 802.1q vlan which is 
what a lot of people think it is. 'vlan' in qemu terms means a pseudo 
network hub that gets set up inside the qemu process. one or more 
network frontends, i.e. a guest network device, and network backends, 
i.e. a host tap device, get connected to this pseudo hub which blindly 
passes packets between devices. it doesn't do anything related to 802.1q 
vlans and doesn't inspect the packets. it just passes them along.

the traditionally accepted way of separating vms into actual 802.1q 
vlans has been to use vconfig on the host to create a vlan network 
interface and then create a linux bridge for each vlan which has the 
vlan interface connected to it. then you would connect the appropriate 
tap interfaces to the bridge for each vlan. this method works well. 
another way to do this is to use openvswitch and configure vlans in it 
with an uplink using your regular interface. it is a slightly more 
complicated system to configure and less documentation out there but a 
more advanced way of doing things.

hopefully that answers your question.

mike