配置网桥后没有网络连接的ubuntu KVM来宾

Question

我正在尝试将KVM来宾（Ubuntu 18.04）像网络中的其他真实服务器一样添加到本地网络。我在主机系统（Ubuntu 18.04）中配置了KVM桥接器接口，它在连接时工作正常。主机系统可通过本地网络访问其他服务器。

主机系统的netplan配置：

$ cat 01-netcfg.yaml
# This file describes the network interfaces available on your system
# For more information, see netplan(5).
network:
  version: 2
  renderer: networkd
  ethernets:
    eno1:
      dhcp4: false
  bridges:
    br0:
      interfaces: [eno1]
      addresses: [192.168.1.105/24]
      gateway4: 192.168.1.1
      nameservers:
        addresses: [x.x.x.x, x.x.x.x]
      dhcp4: false

ip a输出显示网桥接口：

    10697: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 62:cb:37:3c:c0:70 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.105/24 brd 192.168.1.255 scope global br0
       valid_lft forever preferred_lft forever
    inet6 fe80::60cb:37ff:fe3c:c070/64 scope link 
       valid_lft forever preferred_lft forever

我使用网桥br0创建了KVM网络接口

[virsh net-edit br0输出：

<network>
  <name>br0</name>
  <uuid>d277e3d1-b34e-4b1f-ae69-6a3c8f75626c</uuid>
  <forward mode='bridge'/>
  <bridge name='br0'/>
</network>

developer@serv31:~$ virsh net-list
 Name                 State      Autostart     Persistent
----------------------------------------------------------
 br0                  active     yes           yes
 default              active     yes           yes

KVM来宾域的接口信息：

    <interface type='network'>
      <mac address='52:54:00:14:dc:af'/>
      <source network='br0'/>
      <model type='rtl8139'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
    </interface>

在来宾VM中，我将netplan配置为提供一个静态IP。它确实使用配置的IP引导。

$ cat 50-cloud-init.yaml
network:
  version: 2
  ethernets:
    ens3:
      addresses: [192.168.1.50/24]
      gateway4: 192.168.1.1
      nameservers:
        addresses: [x.x.x.x, x.x.x.x]
      dhcp4: false

来宾VM ip a输出：

$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:14:dc:af brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.50/24 brd 192.168.1.255 scope global ens3
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fe14:dcaf/64 scope link 
       valid_lft forever preferred_lft forever

来宾VM能够访问（ping，telnet）主机系统，主机系统可以到达来宾VM。但是网络中没有其他服务器可以访问来宾VM，并且来宾VM也无法访问Internet。请帮我解决这个问题。如果需要更多信息，请告诉我。

Answer 1

sudo iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
sudo iptables -A FORWARD -i br0 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i virbr0 -o br0 -j ACCEPT
sudo iptables -I FORWARD 1 -i br0 -o br0 -j ACCEPT

以上规则解决了这个问题。