Understanding virtual switches in Linux

arpbridgeipnetworking

I am confused by the way I have to set up virtual switches in Linux. I
proceeded as follows:

ip link add name br0 type bridge
ip link set br0 up

This should create a virtual switch called br0. Now, let's
suppose I have a physical network device called eth0 and a tap
device vnet0 created by KVM/qemu on my machine. The tap device
is automatically attached to br0 (by configuration) and eth0 can
be added by hand:

ip link set eth0 master br0

Both devices should now be attached to the switch br0.

I assigned the IP address 192.168.1.1 to eth0 and
192.168.1.2 to the network interface inside the
virtualization. Of course the tap interface itself doesn't
know anything about this address.

If I had exactly this setting with a physical switch instead
of a virtual one, I would expect to be able to ping the
address 192.168.1.2 from the host system. However, this IP cannot be reached via ping:

PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
From 192.168.1.2 icmp_seq=1 Destination Host Unreachable
...

Why is that?

I expected eth0 to send an ARP request into all Ethernet segments it's part of. This is the physical one, but also the one defined by br0. The ARP request should have been answered by vnet0 with it's MAC address.

The solution I found was to assign an IP address to br0 as well:

ip addr add 192.168.1.3/24 dev br0

Now the ping works fine.

Best Answer

I assigned the IP address 192.168.1.1 to eth0

That's where this setup went wrong. eth0 has been set as a bridge member interface (layer 2) and therefore should not have any IP (layer 3) address.

(You probably ended with a sort of broken configuration involving two direct routes both to 192.168.1.0/24) via 2 different interfaces, only one of which worked. But the exact details of the incorrect setup don't really matter.)

Why is that?

I expected eth0 to send an ARP request into all Ethernet segments it's part of. This is the physical one, but also the one defined by br0.

eth0 won't send any ARP. It's no longer a layer 3 interface once it's part of a bridge.

  • The (layer 2) ports on this bridge are
    • eth0,
    • tap0, and
    • the bridge itself.
  • The (layer 3) participants on this bridge are (in the same order)
    • All of the devices that can be reached through eth0 (most likely: a bunch of other devices on your local network)
    • Whatever is at the other and of tap0 (which is likely one thing)
    • The br0 interface
Related Question