新建 ihh.xml

# cat /etc/libvirt/qemu/networks/ihh.xml
<network>
  <name>ihh</name>   # 名称
  <forward mode='nat'/
  <bridge name='ihh0' stp='on' delay='0'/>    # 新桥接接口
  <mac address='52:54:00:cb:ac:6e'/>  # 网关mac
  <ip address='192.168.166.1' netmask='255.255.255.0'>  # 网关ip
    <dhcp>
      <range start='192.168.166.10' end='192.168.166.254'/>   # dhcp 
    </dhcp>
  </ip>
</network>

dhcp 默认会启动 dnsmasq 进行分配, 也可以不添加手动分配

启动 ihh 接口

 # virsh net-define /etc/libvirt/qemu/networks/ihh.xml
 # virsh net-list --all
 Name                 State      Autostart     Persistent
----------------------------------------------------------
 ihh                  inactive   no            yes
 # virsh net-start ihh
Network ihh started

 #  ifconfig ihh0
 ihh0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.166.1  netmask 255.255.255.0  broadcast 192.168.166.255
        ether 52:54:00:cb:ac:6e  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
 # virsh net-autostart ihh
 # virsh net-list --all
 Name                 State      Autostart     Persistent
----------------------------------------------------------
 ihh                  active     yes           yes

修改虚拟机 xml 桥接到 ihh0 接口

    <interface type='bridge'>
      <source bridge='ihh0'/>
      <mac address='fa:16:fb:16:a9:cb' />
      <model type='virtio'/>
    </interface>

iptables 配置 双向nat

• dnat

-A PREROUTING -d 5.5.5.5/32 -j DNAT --to-destination 192.168.166.10

• snat

-A POSTROUTING -s 192.168.166.10/32 -o eth0 -j SNAT --to-source 5.5.5.5

virsh 虚拟网络管理命令:

• virsh net-list [–all] 列出虚拟网络
• virsh net-start 启动虚拟交换机
• virsh net-destroy 强制停止虚拟交换机
• virsh net-define 根据xml文件创建虚拟网络,要用绝对路径定义
• virsh net-undefine 删除一个虚拟网络设备
• virsh net-edit 修改虚拟机交换机配置
• virsh net-autostart 设置虚拟交换机开机自启动

Iptables处理数据包详细流程图