I'm building a small lab with two Debian Trixie VMs: one will act as a router and DHCP server, while the other should obtain a lease from it and reach the Internet through the router. Both VMs are attached to the same libvirt network, but they cannot communicate—even when I manually assign IP addresses. The router VM's nftables rules are disabled and flushed. The network definition currently creates a bridge named virbr1, but it does not define an IP address or DHCP range because I want the router VM, not libvirt, to provide DHCP. How can I verify that the isolated network is active and get the two VMs talking?
2 Answers
Adding an `` section and DHCP range would make libvirt provide addressing, but that is not required for two VMs to exchange packets. Since you want the router VM to handle DHCP, leave those out and configure the router’s interface with a static address such as `192.168.1.1/24`, then bind your DHCP service to that interface. Give the client a temporary address in the same subnet to test connectivity first. If that still fails, inspect the VM definitions with `virsh domiflist `, make sure the virtual NICs are connected, and verify the interfaces are up with `ip link` inside each guest.
An isolated libvirt network can work as a plain layer-2 switch; it does not need an IP address or a libvirt DHCP range. The router VM should provide DHCP on its virtual NIC. First verify that the network is actually active with `virsh net-list --all`, and check the bridge with `ip link show virbr1`. Also confirm that both guest NICs are attached to `isolated-network` and that their interfaces are enabled inside the guests. `NO-CARRIER` generally means the bridge currently has no active attached ports, so check the VM interface state and use `tcpdump` on virbr1 and inside both guests while bringing an interface up or sending DHCP traffic.
The bridge showed `NO-CARRIER` and `state DOWN`, and packet captures showed no traffic at all. I had assumed the network was active because the management UI displayed it as enabled. I’ll check the guest attachments and interface states rather than adding a libvirt address or DHCP pool.