I'm building a small lab with two Debian Trixie VMs: one will act as a router and DHCP server, while the other should obtain a DHCP lease from it and eventually reach the Internet. Both VMs are attached to the same libvirt isolated network, but they cannot ping each other—even when I manually assign addresses on both guests. nftables is disabled and its rules have been flushed on the router VM.
The network definition currently contains only a bridge, MAC address, and domain name:
isolated-network
2d9a40eb-c078-4c7e-998e-4ed1bf46786e
I do not want libvirt to provide DHCP; the router VM should provide it. What needs to be configured or checked so the two guests can communicate over this isolated virtual switch?
2 Answers
The XML is fine for a simple layer-2 network, and you do not need to add an IP address or DHCP range to the libvirt bridge if the router VM is supposed to provide DHCP. Those settings would make libvirt itself act as the gateway and DHCP server, which is not what you want.
First verify that both VM interfaces are actually attached to this network and that the guests have brought their interfaces up. On the host, check `ip link show virbr1` and inspect the bridge members with `bridge link` or `brctl show`. A `NO-CARRIER` bridge with no traffic usually means there are no active guest NICs connected to it, or the guest interfaces are down. Inside both VMs, check `ip link` and bring the relevant interface up if necessary.
Once both NICs are connected and up, assign addresses temporarily—for example, 192.168.1.1/24 on the router and 192.168.1.2/24 on the client—and test with ping. Use tcpdump on the guests and on `virbr1` to confirm that ARP and DHCP packets are crossing the bridge. After basic connectivity works, run the DHCP service on the router VM and configure its other interface for Internet access and forwarding.
Adding an `` section and DHCP range is only necessary if you want libvirt’s built-in dnsmasq to supply addresses. It is not required for VMs to communicate, and it would conflict with the design where the router VM runs DHCP.
Keep the network as an isolated bridge, attach both virtual NICs to `isolated-network`, and confirm the network is active with `virsh net-info isolated-network`. Then check the bridge’s forwarding database and packet capture on the host. If manually assigned addresses still cannot ping, the likely problem is that one or both guest adapters are disconnected, disabled, or attached to a different virtual network—not the absence of a bridge IP.
That explains the confusing `NO-CARRIER` state. I had assumed virt-manager showing the network as active meant the bridge had usable guest links. I’ll check the VM NIC attachments and make sure the interfaces are up instead of adding libvirt DHCP.