Wondering how to fix Guest unable to reach host using macvtap interface? We can help you.

Generally, guest virtual machines can communicate with other guests. But at times a guest will not be able to connect to the host machine after being configured to use a macvtap network interface.

Here at Bobcares, we get requests from our customers to fix similar issues of guest virtual machines as a part of our Server Management Services.

Today let’s see what causes this issue and how our Support Engineers fix this for our customers.

What makes the Guest unable to reach host using macvtap interface

When we configure a guest virtual machine to use a type=’direct’ network interface such as macvtap, despite having the ability to communicate with other guests and other external hosts on the network, the guest cannot communicate with its own host.

However, this is actually not an error as it is the defined behaviour of macvtap. Because of the way in which the host’s physical Ethernet is attached to the macvtap bridge, traffic into that bridge from the guests that is forwarded to the physical interface cannot be bounced back up to the host’s IP stack.

Additionally, traffic from the host’s IP stack that is sent to the physical interface cannot be bounced back up to the macvtap bridge for forwarding to the guests.

Methods to fix the issue:

Following are the two methods that our Support Engineers follow to fix this error:

 1. Creating a separate macvtap interface for the host

We can create a separate macvtap interface for host use and give it the IP configuration previously on the physical ethernet. In this way, the host would be an equal peer attached to the macvlap bridge and thus guest and host could communicate directly.

2. Using libvirt for creating an isolated network 

Use libvirt to create an isolated network and create a second interface for each guest virtual machine that is connected to this network. The host and guests can then directly communicate over this isolated network, while also maintaining compatibility with NetworkManager.

Following are the steps for creating an isolated network with libvirt

1. First, we need to add and save the following XML in the /tmp/isolated.xml file. If the 192.168.254.0/24 network is already in use elsewhere on our network, we can choose a different network.

...
<network>
<name>isolated</name>
<ip address='192.168.254.1' netmask='255.255.255.0'>
<dhcp>
<range start='192.168.254.2' end='192.168.254.254'/>
</dhcp>
</ip>
</network>
...

2.  Then create the network with the following command:

virsh net-define /tmp/isolated.xml

3. After that, we need to set the network to autostart with the following command:

virsh net-autostart isolated

4. And start the network with the following command:

virsh net-start isolated

5. Now, edit the configuration of each guest that uses macvtap for its network connection using the following command:

virsh edit name_of_guest

Add a new <interface> in the <devices> section similar to the following (note the <model type=’virtio’/> line is optional to include):

...
<interface type='network' trustGuestRxFilters='yes'>
<source network='isolated'/>
<model type='virtio'/>
</interface>

6. Finally, shut down, then restart each of these guests.

Since this new network is isolated to only the host and guests, all other communication from the guests will use the macvtap interface.

[Need Assistance? We are happy to help you!]

Conclusion

In short, we saw how our Support Engineers fix the issue with guests unable to reach the host using macvtap interface.