# QEMU and tun/tap not working

## fourhead

I want to use TUN/TAP with QEMU to have networking within WinXP. According to QEMU's docs, I just need to load the TUN kernel module, which I did, and /dev/nettun has to be there, which IS there. Then, I should do "ifconfig tun0 172.20.0.1 up", but when I'm doing this as root it tells me:

SIOCSIFADDR: No such device

tun0: unknown interface: No such device

What am I doing wrong and/or missing here? I exactly followed the docs, so I have no idea whats going wrong.

Tom

----------

## eyeswide

you need to use a script to set up the network after qemu creates the tun0 device, which only exists while qemu is running. /etc/qemu-ifup is what qemu calls by default, you can change the script location if you use the -n option

here's my /etc/qemu-ifup

```

#!/bin/sh

sudo /sbin/ifconfig $1 192.168.3.1

```

limitations: there's probably a better way to run ifconfig as root other than using sudo. And i haven't tried running more than 1 guest os at a time.

these are if you want the guest os to have net access. change the ip's to whatever you have above

```

/sbin/iptables -D POSTROUTING -t nat -s 192.168.3.0/24 -d ! 192.168.3.0/24 -j MASQUERADE >& /dev/null

/sbin/iptables -t nat -s 192.168.3.0/24 -d ! 192.168.3.0/24 -A POSTROUTING -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward

```

----------

## fourhead

Thanks, I had to chmod 666 the tun device, and then QEMU says it's connected to tun0. I just emerged iptables, but afaik I also need some kernel modules for iptables to work right? Could you tell me which ones are needed, I have NO idea of iptables sorry. If I don't do the iptables thingy, I still don't have any network within WinXP. I also tried it with -user-net, but WinXP always tells me that I have "Limited or no network access". It's set to use DHCP but it doesn't get an IP. Do I have to do this manually within WinXP or does QEMU provide some simple DHCP?

Tom

----------

## eyeswide

sorry for the delay,

 if your qemu_ifup script is set to 192.168.3.1 set the xp to use 192.168.3.10 and gateway as 192.168.3.1, nameservers copy from /etc/resolv.conf on the gentoo host

you should be able to ping 192.168.3.1 from within xp without iptables setup at all.

you could try to run a cd image such as the gentoo livecd or knoppix to get the hang of it. I know people have had problems with xp networking. check here for how to fix that:

http://www.dad-answers.com/qemu-forum/

http://lists.gnu.org/archive/html/qemu-devel/2005-04/threads.html

for iptables enable all options in below will cover it: 

Device Drivers -> Networking support -> Netwoking options ->Network packet filtering-> IP: netfilter...

i hate iptables, i ended up using webmin to get a basic firewall setup...but even that's not so great. I've spent hours looking at man iptables and the howto's etc. Finding an automated script such as shorewall or simalar is essential imo. 

I don't think dhcpd is part of qemu, but you could set up dhcp on the host computer. It is the same as doing a firewall or home router setup. but you don't really need it.

----------

## fourhead

Hi, I have another little problem and I hope you can help me. I want TWO instances of QEmu VMs to communicate with each other.

That's what I've done so far:

Enable TUN, edit qemu-ifup to use 10.0.0.1, start first QEmu. I configured Gentoo within the QEmu VM (gentoo-1) to use 10.0.0.10, which works, and I can also ping 10.0.0.1.

Then, I started the second QEmu instance, and a second TUN interface (tun1) came up with the same 10.0.0.1 IP. Within the second QEmu, I configured gentoo-2 to use 10.0.0.20, and I can also ping 10.0.0.1, but I can't ping gentoo-1 from gentoo-2 or vice versa. Somehow, I need to connect tun0 and tun1 on the host so that a ping from gentoo-1 goes trough those tun devices to gentoo-2. Is this possible at all????

Tom

----------

## eyeswide

hello again, 

for that you need to setup bridging or routing of the two tun interfaces. note that by default qemu uses the same MAC address for the first network card in each client. so they cannot talk to each other unless you change it with the qemu -macaddr option. perhaps your setup will work just by changing that. Here's the bridging setup i came up with this sunday morning. There is also the tun-fd option for qemu which may be the same thing but it didn't work as i expected and i couldn't find any documentation for it.

```

| host |---| bridge0 10.0.0.1 | ------ | (tun0 promisc, no ipaddress) |----| GentooClient1 10.0.0.10 |

                          \

                           ---------------------| (tun1 promisc, no ipaddress) |----| GentooClient2 10.0.0.11 |

```

With this setup you cannot ping the tun interfaces as they have no ip address and are wrapped into the bridge0 interface

```

emerge bridge-utils

brctl addbr bridge0

brctl sethello bridge0 1     #speeds up the discovery of clients

```

make /etc/qemu-ifup-bridge:

```

#!/bin/sh

sudo /sbin/ifconfig $1 promisc up

sudo /sbin/btctl addif $1 bridge0
```

start clients:

```

qemu -nics 1 -n /etc/qemu-ifup-bridge -macaddr 52:54:00:12:34:11 -cdrom install-x86-minimal-2005.1.iso -boot d &

qemu -nics 1 -n /etc/qemu-ifup-bridge -macaddr 52:54:00:12:34:12 -cdrom install-x86-minimal-2005.1.iso -boot d &
```

(note unique mac address)

host (as root):

```

ifconfig bridge0 10.0.0.1 up
```

when the clients are running set them up as follows:

GentooClient1

```

ifconfig eth0 10.0.0.10
```

GentooClient2

```

ifconfig eth0 10.0.0.11
```

to enable internet access use the bridge0 interface for masquerede instead of tun0 or eth0

for each guest:

```

route add default gw 10.0.0.1

echo "nameserver someipaddr" >> /etc/resolv.conf
```

that was fun to figure out   :Smile: 

linkage:

http://bridge.sourceforge.net/document.html

http://m2.dad-answers.com/qemu-forum/viewtopic.php?t=144

----------

## fourhead

Hi, thanks so much and sorry for my delayed answer, I was testing your solution. Well it all works except internet access for the guests. My DSL router has 192.168.1.1, my host has 192.168.1.10, the bridge has 192.168.1.30, the twoguests have .40 and .50. On the host, I've set two routes to .40 and .50 to go trough .30, so I can ping host->guest. Within the guests, the default route is .30, so I can ping guest->bridge and guest->host and guest->guest, but I can't reach anything beyond that, not even my DSL router. I scp'ed the host's resolv.conf to both guests. Am I mising something? IPTables?

Tom

----------

## eyeswide

well my solution was to make the bridge/clients on a different subnet not the same one as you have done.  ie put bridge0 on 192.168.3.0 instead of 192.168.1.0, and run iptables NAT for that subnet on the host machine... one tool i use to debug is to run tcpdump -i <interface>, and then ping around to see what packets are getting through and which way.

to nat in your situation i would do on the host:

(assuming eth0 is 192.168.1.xx)

```

brctl addbr bridge0

brctl sethello bridge0 1 

ifconfig bridge0 192.168.3.1 up

/sbin/iptables -D POSTROUTING -t nat -s 192.168.3.0/24 -d ! 192.168.3.0/24 -j MASQUERADE >& /dev/null

/sbin/iptables -t nat -s 192.168.3.0/24 -d ! 192.168.3.0/24 -A POSTROUTING -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward 

```

and clients:

ifconfig eth0 192.168.3.10

set the gateway to 192.168.3.1

set nameservers the same as you have it.

nat uses some iptables kernel modules, so if you get errors with iptables you just need add it and recompile the kernel...

if you really want to get everything on the same subnet, you can do that, just ignore everything that i have said and do what is said here: http://m2.dad-answers.com/qemu-forum/viewtopic.php?t=144

I don't like to take down my internet access while i'm playing with this stuff. So i chose the nat way.

----------

