# Networking

## Host networking

### metadata

- unique `name` of the network in scope of a single host
- `uuid` is autogenerated
- when set to yes, the optional parameter `ipv6` enables a network definition with no IPv6 gateway addresses specified to have guest-to-guest communications
- `trustGuestRxFilters`

### connectivity

- `bridge` defines the bridge interface, which is created if it doesn't exists
    - `name` - name of the net interface
    - `stp` - spanning tree protocol
    - `delay` - forward delay in seconds
    - `macTableManager` - setting to 'libvirt' disables kernel management (vlan filtering is enabled on the bridge)
    - `zone` - firewalld zone for the bridge with forward mode of 'nat'
- `mtu` - specific MTU for the network
    - not specifying the mtu gives a default `1500`
- `domain` - optinal and only used with `forward` mode of 'nat' or 'route'
    - `name` - DNS domain of the DHCP server
    - `localOnly` - defaults to 'no' and sets the internal/local only domain resolution
- `forward` - inclusion indicates that the virtual network is to be connected to the physical LAN. If this element is omitted, the network isolated from any other network (unless a guest connected to that network is acting as a router)
    - `interface` - interface to be used
        - `dev` - name of the host's interface
    - `mode` - method of forwarding traffic and defaults to 'nat'
        - `nat`
            ```xml
            <forward mode='nat'>
              <nat>
                <address start='1.2.3.4' end='1.2.3.10'/>
                <port start='500' end='1000'/>
              </nat>
            </forward>
            ```
            - setting start and end address the same means single IPv4 address
            - firewall rules are added to allow outbound connections
            - `dev` - firewall rules restricts routing to specified device only
        - `route` - forwards traffic without NAT directly to physical LAN via host's IP routing stack
            - `dev` - firewall rules restricts routing to specified device only
            - to restrict incoming traffic to a guest on a routed network, you can configure `nwfilter` rules on the guest's interfaces
        - `open` - forwards traffic without nAT directly to physical LAN via host's IP routing stack
            - No firewall rules
            - to restrict incoming traffic to a guest on a routed network, you can configure `nwfilter` rules on the guest's interfaces
        - `bridge` - at the IP level, the guest interface appears to be directly connected to the physical interface
            - describes 3 various scenarios
                1. an existing host bridge that was configured outside of libvirt
                2. an existing Open vSwitch bridge that was configured outside of libvirt
                3. an interface or group of interfaces to be used for a "direct" connection via macvtap using macvtap's "bridge" mode (if the forward element has one or more <interface> subelements)
        - `private` - macvtap 'direct' connection of each guest to the network
            - private mode
        - `vepa` - macvtap 'direct' connection of each guest to the network
            - vepa-capable hardware switch
        - `passthrough` - macvtap 'direct' connection of each guest to the network
        - `hostdev` - PCI passthrough allows PCI devices to appear and behave as if they were physically attached to the guest operating system
- `bandwidth` - quality of service

### setting VLAN tag

```xml
<network>
  <name>ovs-net</name>
  <forward mode='bridge'/>
  <bridge name='ovsbr0'/>
  <virtualport type='openvswitch'>
    <parameters interfaceid='09b11c53-8b5c-4eeb-8f00-d84eaa0aaa4f'/>
  </virtualport>
  <vlan trunk='yes'>
    <tag id='42' nativeMode='untagged'/>
    <tag id='47'/>
  </vlan>
  <portgroup name='dontpanic'>
    <vlan>
      <tag id='42'/>
    </vlan>
  </portgroup>
</network>
```


## KVM overview

eno1
- physical interface

virbr0
- virtual bridge
- includes IP and acts as s router/switch and includes NAT (usually)

virbr0-nic
- connection of the bridge to the physical interface
- allows the KVM to get out to the physical interface `eno1`

vnet0
- indicates that its one VM that is up and running

### bridging

enable KVM networking with the outside world
- create a bridge and set it up
- set target interface up
```bash
sudo ip link add name my-br0 type bridge
sudo ip link set dev my-br0 up
sudo ip link set dev enp0s3 up
sudo ip link set dev enp0s3 master my-br0
```

NOTE: this is the same behaviour as for automatic bridging of libvirt networking including e.g. NAT forward.