From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sterling Windmill Subject: routing vs bridging with tap Date: Sun, 7 Dec 2008 20:37:58 -0500 (EST) Message-ID: <289461627.1191228700278079.JavaMail.root@mail.ampx.net> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit To: kvm Return-path: Received: from mail.ampx.net ([208.64.38.105]:58649 "EHLO mail.ampx.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753560AbYLHBof (ORCPT ); Sun, 7 Dec 2008 20:44:35 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by mail.ampx.net (Postfix) with ESMTP id 2E90BC18157 for ; Sun, 7 Dec 2008 20:37:59 -0500 (EST) Received: from mail.ampx.net ([127.0.0.1]) by localhost (mail.ampx.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yHH1y-ZUhMxh for ; Sun, 7 Dec 2008 20:37:58 -0500 (EST) Received: from mail.ampx.net (mail.ampx.net [208.64.38.105]) by mail.ampx.net (Postfix) with ESMTP id 25F36C18060 for ; Sun, 7 Dec 2008 20:37:58 -0500 (EST) Sender: kvm-owner@vger.kernel.org List-ID: I'm playing with KVM for purposes of eventually deploying it into a hosting environment and am using tap devices for my guest networking. I've routed a single IP to the tap device of a guest and enabled proxy_arp on the tap device used for the guest and the host's physical ethernet device. Networking works fine inside of the guest in this configuration, but a side effect seems to be that when migrating this guest from one host to another, the guest holds arp cache entries which point to the old MAC address and cause issues with networking. After clearing the guest's arp table proper network behavior resumes on the new host. Unfortunately, this work around causes a loss in connectivity until the arp cache can be cleared and I won't have access to log into the guests and do this once my setup is in production. I'm using routed tap devices instead of bridging the tap devices with the physical ethernet on the host because I have it in my mind that routing is better than bridging from a security and isolation standpoint when dealing with potentially untrusted guest virtual machines. Am I causing myself unnecessary pain? Should I just bridge everything together? Any ideas? Thanks in advance, Sterling Windmill