Permissions for bridged network with Qemu
 

Slackware64 14.1 host; kvm modules loaded; qemu 2.3.0

Some years ago I successfully set up a qemu-kvm host with bridged networking. My setup was a little unusual: instead of bridging to a physical adapter I created a dummy interface on the host and bridged to that; I also created a tap interface for the guest and connected that tap interface to the same bridge. The bridge got an address like 10.40.40.1; ip forwarding was set up and iptables masqueraded connections from 10.50.50.0 to the physical adapter, which was something like 192.168.1.100, and then on to the router. Don't ask me why I prefer this setup; I just don't like bridging to the external adapter.

I used brctl and tunctl to bring up the interfaces.

It worked well, but I had to invoke qemu as root user, which always left me uncomfortable.

I am now trying to implement a similar setup with the iproute2 suite, hoping to invoke qemu this time as a regular user. Here's how I bring the virtual network up as root user:

Here's how I invoke qemu as a regular user (irrelevant portions snipped):

Here's what ip link show reports when the virtual network is up:

And here's what the same shows when the guest is started:

Here's what bridge link show br0 reports:

I assign a fixed address to the guest - 10.40.40.100, 255.255.255.0 and gw 10.40.40.1 with nameserver 8.8.8.8. However, I am unable to get a connection to the outside world, or even to the gateway for that matter. ping 10.40.40.1 returns host unreachable. Since I am not too well up on iptables and netfilter I generate the firewall script using Eric Hameleer's easy firewall generator for Slackware, setting eth0 to my external interface and br0 to the LAN side, with gateway enabled.

Is this a permissions issue, or have I something wrong in the configuration above?

I spent yesterday studying the qemu documentation more closely, and ended up getting netdev bridge working with the qemu-bridge-helper script. I had to add the s bit to this script (chmod u+s /usr/local/libexec/qemu-bridge-helper), as suggested in one of the resources I found online. Once I did that and created /usr/local/etc/qemu/bridge.conf with the single line "allow br0" I was able to run guests as a regular user. All that is required on the host is to create a bridge; no need to create tap or dummy adapters at all, and eth0 is not added to the bridge either, so I'm satisfied with this setup.