On Tue, 25 Jan 2022 01:48:24 +0100 Peter Boy pboy@uni-bremen.de wrote:
If you want your VMs to have access to the public network, then you have to share the host's public interface. The most convenient option is mac-vlan and to avoid a bridge. You don’t need to configure the host interface, but just the VMs to use „direct attachment“ in KVM/libvirt-speech. See Fedora Server documentation at https://docs.stg.fedoraproject.org/en-US/fedora-server/virtualization-vm-ins... (it’s the staging version).
Konfiguration is much easier and it causes less system load. The only disadvantage is that the VMs cannot communicate directly with the host. But it is usually better to use an internal, protected network for this.
This, for me, is a fatal limitation. The web server needs to access the database server and so on. At home I have just one network and every thing is internal. At work we have an internal network and all internet-facing services are on an isolated network with an industrial grade firewall and application filter severely restricting access from the internet. All the hosts are already on an “internal” network of some variety, so setting up a another one seems redundant.
I also feel that configuring the host for bridge mode is much more convenient than installing a separate physical network.
Jim