Bug 539744

Summary: No network for any KVM virtual guests
Product: [Fedora] Fedora Reporter: Matěj Cepl <mcepl>
Component: libvirtAssignee: Daniel Veillard <veillard>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 12CC: berrange, clalance, crobinso, ikke, itamar, jforbes, kimmo.vuorinen, maurizio.antillon, mcepl, pcfe, veillard, virt-maint
Target Milestone: ---Keywords: Triaged
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-12-15 13:43:30 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 514891    
Description Flags
output of reproducal
nat network config
libvirt config, only logs changed
libvirtd debug log
"ip a" before starting libvirtd
"ip a" after starting libvirtd
libvirtd debug log - same problem none

Description Matěj Cepl 2009-11-20 18:05:52 EST
Description of problem:
I have configuration which went unchanged since a week ago when I had perfectly working laptop with four virtual machines (RHEL4, RHEL5, Rawhide, Fedora11), but something has changed and currently no virtual machine has network access.

I have virtual network configured:
bradford:~# virsh net-list
Jméno               Stav       Automatické spuštění
default              aktivní   yes       

bradford:~# virsh net-dumpxml default
  <forward mode='nat'/>
  <bridge name='virbr0' stp='on' delay='0' />
  <ip address='' netmask=''>
      <range start='' end='' />

bradford:~# /usr/sbin/brctl show
bridge name	bridge id		STP enabled	interfaces
pan0		8000.000000000000	no		
virbr0		8000.0a9abf8527c5	yes		vnet0

Version-Release number of selected component (if applicable):
bradford:jetpack$ uname -a
Linux bradford #1 SMP Mon Nov 16 20:38:45 EST 2009 x86_64 x86_64 x86_64 GNU/Linux
bradford:jetpack$ rpm -qa \*virt\* \*qemu\* \*kvm\* kernel dnsmasq|sort -u

How reproducible:

Steps to Reproduce:
1.start a virtual machine
Actual results:
network doesn't start

Expected results:
it should as it was

Additional info:
Comment 1 Kimmo Vuorinen 2009-11-27 11:23:12 EST
This is exactly what I have experienced, and problem appeared while system was running. I am not using libvirt so I think problem is kernel related.

More info about my configuration at:
Comment 2 Justin M. Forbes 2009-12-01 11:28:53 EST
Do you have any custom iptables rules? Does the problem persist with the update kernel-
Comment 3 Ilkka Tengvall 2009-12-03 04:02:43 EST
I have been hit by the same problem. It seems that the masquerade rules from networkAddMasqueradingIptablesRules do not get run always.

I see the masquerade rule from bridge - tun/tap to eth0 gets created only at boot time if ever. My KVM guests don't get to network anymore. See the reproducal with output in attachements, here's the magick to trigger the bug:

sudo service iptables status
 - right after boot I can see the masquerade rule
sudo service libvirtd stop
sudo service iptables stop
sudo service iptables start
sudo service libvirtd start
sudo service iptables status
 -> masquerade rule is gone

I attach output for those commands along with the debug log of libvirtd and config for nat interface.

about the versions:

rpm -q kernel libvirt qemu-kvm

$ uname -a
Linux whipper.mobile.fp.nsn-rdnet.net #1 SMP Sat Nov 7 21:11:14 EST 2009 x86_64 x86_64 x86_64 GNU/Linux

And I can reproduce this also on my f12 i386 laptop. Actually I can not get network to work on either machine.
Comment 4 Ilkka Tengvall 2009-12-03 04:03:21 EST
Created attachment 375696 [details]
output of reproducal
Comment 5 Ilkka Tengvall 2009-12-03 04:03:53 EST
Created attachment 375697 [details]
nat network config
Comment 6 Ilkka Tengvall 2009-12-03 04:04:23 EST
Created attachment 375698 [details]
libvirt config, only logs changed
Comment 7 Ilkka Tengvall 2009-12-03 04:09:48 EST
Created attachment 375703 [details]
libvirtd debug log
Comment 8 Ilkka Tengvall 2009-12-03 04:11:15 EST
Created attachment 375704 [details]
"ip a" before starting libvirtd
Comment 9 Ilkka Tengvall 2009-12-03 04:11:42 EST
Created attachment 375706 [details]
"ip a" after starting libvirtd
Comment 10 Matěj Cepl 2009-12-03 10:14:41 EST
(In reply to comment #2)
> Do you have any custom iptables rules? Does the problem persist with the update
> kernel-  

Actually, I cannot reproduce it anymore (not sure when it started to work)

bradford:~$ uname -a
Linux bradford #1 SMP Sat Nov 21 15:57:45 EST 2009 x86_64 x86_64 x86_64 GNU/Linux
Comment 11 Justin M. Forbes 2009-12-03 14:28:35 EST
Ikka, does libvirt from the virt-preview repository help your situation here?

Comment 12 Ilkka Tengvall 2009-12-04 01:27:18 EST
Created attachment 376008 [details]
libvirtd debug log - same problem

updated from preview repo, problem still exists.

Dec 04 08:13:02 Updated: libvirt-client-0.7.4-1.fc12.x86_64
Dec 04 08:13:03 Updated: libvirt-python-0.7.4-1.fc12.x86_64
Dec 04 08:13:03 Updated: 2:qemu-img-0.11.0-12.fc12.x86_64
Dec 04 08:13:05 Updated: 2:qemu-common-0.11.0-12.fc12.x86_64
Dec 04 08:13:06 Updated: 2:qemu-system-x86-0.11.0-12.fc12.x86_64
Dec 04 08:13:06 Installed: zbar-0.10-1.fc12.x86_64
Dec 04 08:13:08 Updated: gstreamer-plugins-bad-0.10.17-1.fc12.x86_64
Dec 04 08:13:08 Updated: 2:qemu-kvm-0.11.0-12.fc12.x86_64
Dec 04 08:13:09 Updated: libvirt-0.7.4-1.fc12.x86_64
Dec 04 08:13:15 Updated: virt-manager-0.8.1-1.fc12.noarch

One thing I need to ask, I changed the eth0 config so that it is not controllable from network manager. But this is the way it worked still in F11.
Comment 13 Ilkka Tengvall 2009-12-10 03:24:11 EST
FYI, kernel updated, still exists:, also I changed back the network manager to control eth0. No difference.
Comment 14 Kimmo Vuorinen 2009-12-10 04:30:15 EST
Ilkka, what does brctl showmacs <bridge> report for your system? I think there is a problem with qemu setting up bridges. It doesn't seem to matter if virtio is used or not.
Comment 15 Ilkka Tengvall 2009-12-11 14:54:48 EST
$ sudo brctl show 
bridge name	bridge id		STP enabled	interfaces
pan0		8000.000000000000	no		
virbr0		8000.000000000000	yes		
virbr1		8000.000000000000	yes		
[itengval@whipper ~]$ sudo brctl showmacs virbr0 
port no	mac addr		is local?	ageing timer
[itengval@whipper ~]$ sudo brctl showmacs virbr1
port no	mac addr		is local?	ageing timer
Comment 16 Ilkka Tengvall 2009-12-15 06:36:27 EST
BTW, I have downloaded the libvirt debuginfo and can hit it with a debugger if you just give a hint what to check.
Comment 17 Justin M. Forbes 2009-12-15 13:43:30 EST
libvirt has no sane was of integrating with iptables

We previously tried using lokkit, but if the user had configured iptables
manually (i.e. without lokkit) we'd end up clobbering their rules

We simply need a way to say to iptables "we've added these rules, please load
them when you restart" without overwriting the current configuration. We also
need lokkit/system-config-firewall to not overwrite these rules when the user
modifies the configuration

The whole sorry saga is well documented in bug #227011

*** This bug has been marked as a duplicate of bug 227011 ***