Networks

Three modes, and what is not touched

A network is NAT (its own range, a way out), isolated (its own range, no way out) or bridged (the guests sit directly on the existing network). Networks that were already on the host appear as unmanaged: Phillux shows them and lets them start and stop, but does not create them and does not rewrite them.

Nothing on the host's interfaces is configurable here. That is a deliberate limit rather than a missing feature — the machine this runs on is reached over exactly those interfaces.

Links between two networks

Two virtual networks do not reach each other, and for two reasons that both sit on the host: libvirt rejects every new connection from outside into a network, and it rewrites the sender address on the way out. Without the second, a guest in the target network would see its own gateway as the sender and every rule in its firewall would be worthless.

So Phillux hangs two chains of its own in front of libvirt's. Nothing of anybody else's rules is changed, deleted or reordered — exactly one jump is added in each of two places, and the chains are written afresh in full at every change. Whoever wants to be rid of the links deletes them, and the host's ruleset stands afterwards as it did before.

A link works in both directions and can be narrowed to a direction, a protocol and a port — down to a single VM talking to a single other one.

A way in, and a name instead of an address

A guest in a NAT network has a way out but no way in, and “the web server in the VM cannot be reached” is the first thing anybody runs into. A forward hands a port of the host through to it.

The target is named as a guest and not as an address. The address comes by DHCP and changes with the lease; the name does not. It is looked up afresh every time the rules are built, by the same watch that keeps the links current.

Fixed addresses and VLAN tags

Which guest is to get which address is settled from outside, as a DHCP reservation. The alternative — setting the address inside the guest — only works where one can get in; a reservation also works for a machine that is still installing and for a Windows guest nobody has logged into yet.

A VLAN tag sits on the guest's own card, which is what VMware calls VST. The guest knows nothing of it: inside there is a plain card, exactly as on a switch port an administrator has put into a VLAN. A guest may have several cards, each in its own VLAN — a firewall has an inside and an outside, and putting both legs in the same VLAN would make it a cable.

The other mode is a trunk, where the guest tags for itself and the host passes the frames through untouched — for a router or a firewall that wants to see the tags.

A bad line, on purpose

Every lab network is faster and more reliable than anything a customer has. That is the one thing a virtual environment gets wrong by default: an application that falls apart at 200 ms of latency looks perfect here and breaks on the day it goes to a branch office over a satellite link.

Latency, jitter, packet loss, duplication, corruption and a rate cap can be set per guest. The rule sits on the traffic going into the guest, so a ping out of it gets the delay once on the way back and the round trip grows by exactly what was set. That is written down rather than papered over with a symmetrical setup whose second half quietly does nothing.