Okay, let me try to explain (Friday is the excuse)

I know nothing about qemu-kvm-libvirt, but at a glance it should
facilitate networking a lot, but I don't know how. Let's turn to the
basics instead.

If you chose tap, which afaik is a way to handle ethernet frames in
userspace, the handler could be any userspace process (e.g.
qemu-kvm-libvirt). So your tap0 is actually one end of the wire. The
opposite end is somewhere in qemu-kvm-libvirt (again, I know nothing
about it, I'm an LXC user) and to reach that end you need the following
route on your host system:


ip route add 192.168.99.0/24 dev tap0

So if you ping some IP address in 192.168.99.0networkfrom the host
system, packets will be routed to your virtualized system and if it has
that IP address it will respond. Of course that system should have the
default route back to 192.168.99.1

Same in LXC, where we use veth, which is a pair of linked interfaces:
one is on the host system, another is assigned to the container .

You do not need a bridge interface.

Once again:

You do not need a bridge interface. In this configuration packets come
from a virtualized system and go through NAT to mlan0. Your NAT rule

iptables -t nat -A POSTROUTING -o mlan0 -j MASQUERADE

looks correct.

The only reason you can't ping 8.8.8.8 even from the host system is
messy routes. Assuming your mlan0 is the way to the Internet, the only
default route should be:

default via 192.168.1.1 dev mlan0

With these ones

0.0.0.0 dev tap0 scope link

default dev tap0 scope link

packets will be directed to the wrong interface and embarrass your
virtualized system. Drop these routes.

You would need a bridge if you wanted your host system and virtualized
system to be on the same ethernet network (domain, segment,...) However,
bear in mind: wifi interfaces in client mode cannot be bridged. In
access point mode that does work, but does not work in client mode. Only
wired interfaces can be freely bridged.

Axy

On 10/6/23 13:37, Mario Marietto via Dng wrote:
> As long as I don't have any routing rules in my home network (static
> or done by routing protocols such as OSPF or RIP), my KVM server will
> be the only host in my network that knows how to reach 192.168.20.0/24
> <http://192.168.20.0/24> (because it has 192.168.20.1 itself). That
> means, my VMs will not be able to reach any other network. The
> simplest approach to get this to work is to do NAT for /outgoing/
> traffic. Now this kind of NAT is an SNAT, not a DNAT. While classic
> SNAT is a one-to-one-mapping, MASQUERADE simply means "replace every
> source IP with the IP on the outgoing interface".
>
> On Fri, Oct 6, 2023 at 8:51 AM Mario Marietto <marietto2008@???>
> wrote:
>

>     Thanks.

>

>     so,maybe this is the solution :

>

>     |# iptables -t nat -A POSTROUTING -o mlan0 -j DNAT # ip tuntap add
>     tap0 mode tap # ip link set dev tap0 up # ifconfig tap0
>     192.168.99.1/24 <http://192.168.99.1/24> # echo 1 >
>     /proc/sys/net/ipv4/ip_forward|

>
>

>     iptables v1.8.9 (nf_tables): DNAT: option "--to-destination" must
>     be specified

>

>     What could be the destination ? thanks.

>

>     On Fri, Oct 6, 2023 at 1:44 AM Gregory Nowak <greg@???> wrote:

>

>         On Thu, Oct 05, 2023 at 02:20:47PM +0200, Mario Marietto via
>         Dng wrote:
>         > I'm trying to set up a bridge on Linux Devuan 5 (host os)
>         with the
>         > goal to give the connectivity to FreeBSD 13.2,that I have
>         virtualized
>         > with qemu-kvm-libvirt.

>

>         If you're trying to setup a bridge, then you're going about it the
>         wrong way.. You'd set that up in /etc/network/interfaces, or
>         in a file
>         under /etc/network/interfaces.d where you bridge your mlan0 to
>         your
>         tap0. This is more involved when using wifi, but it can be
>         done. See
>         man interfaces, the bridge-utils package, and the wpasupplicant
>         package. You mentioned
>         you're using network manager. If so, then you will probably
>         want to
>         dump network manager if you go this route.

>

>         > on Devuan I did :
>         >
>         > # iptables -t nat -A POSTROUTING -o mlan0 -j MASQUERADE

>

>         If you want to keep going the way you are, then I think you
>         want the
>         DNAT target, not MASQUERADE.

>

>         Greg

>
>

>         -- 
>         web site: http://www.gregn.net
>         gpg public key: http://www.gregn.net/pubkey.asc
>         skype: gregn1
>         (authorization required, add me to your contacts list first)
>         If we haven't been in touch before, e-mail me before adding me
>         to your contacts.

>

>         --
>         Free domains: http://www.eu.org/ or mail dns-manager@???

>
>
>

>     -- 
>     Mario.

>
>
>
> --
> Mario.
>
> _______________________________________________
> Dng mailing list
> Dng@???
> https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng