routing vs bridging with tap

[Sterling Windmill <sterling@ampx.net>]

I'm playing with KVM for purposes of eventually deploying it into a hosting environment and am using tap devices for my guest networking.

I've routed a single IP to the tap device of a guest and enabled proxy_arp on the tap device used for the guest and the host's physical ethernet device.

Networking works fine inside of the guest in this configuration, but a side effect seems to be that when migrating this guest from one host to another, the guest holds arp cache entries which point to the old MAC address and cause issues with networking. After clearing the guest's arp table proper network behavior resumes on the new host. Unfortunately, this work around causes a loss in connectivity until the arp cache can be cleared and I won't have access to log into the guests and do this once my setup is in production.

I'm using routed tap devices instead of bridging the tap devices with the physical ethernet on the host because I have it in my mind that routing is better than bridging from a security and isolation standpoint when dealing with potentially untrusted guest virtual machines.

Am I causing myself unnecessary pain? Should I just bridge everything together? Any ideas?

Thanks in advance,
Sterling Windmill