Networking¶

Xen guest networking works by connecting virtual network interfaces (vifs) in guest domains to a bridge in dom0. dom0 then routes or bridges that traffic to the physical network.

Basic bridge setup¶

The most common networking setup is a bridge. dom0 creates a software bridge and attaches both the physical network interface and guest vifs to it. Guests appear on the same network as the physical host.

Most distributions configure this automatically when you install Xen. The bridge is typically named xenbr0.

To check that the bridge is set up:

brctl show

You should see xenbr0 listed with the physical interface (e.g. eth0) as a member.

If the bridge is not set up automatically, you will need to configure it through your distribution’s networking tools. The exact steps vary by distribution.

Configuring guest networking¶

In the guest configuration file, the vif line connects the guest to the bridge:

vif = [ "bridge=xenbr0" ]

Multiple vifs can be added by listing them:

vif = [ "bridge=xenbr0", "bridge=xenbr1" ]

Each entry can also specify a MAC address and other options:

vif = [ "mac=00:16:3e:xx:xx:xx,bridge=xenbr0" ]

Device naming¶

Each paravirtualized network interface is actually a pair of devices: a frontend in the guest and a backend in dom0, linked by a virtual channel.

In the guest, the frontend appears as an ordinary NIC. On Linux it uses the xen-netfront driver and is named ethN as usual.
In dom0, the backend is named vif<domid>.<devid> — for example vif3.0 for the first interface of domain 3. This is the name you attach to a bridge and the name that shows up in ip a on the host.

Choosing a MAC address¶

By default, most toolstacks assign a random MAC address to each vif — static for the guest’s lifetime under libvirt or XAPI, but regenerated on every start under plain xl. Set one explicitly with the mac= option if you need it to stay fixed (for example, for DHCP reservations):

vif = [ "mac=00:16:3e:01:01:01,bridge=xenbr0" ]

If you don’t control your own OUI block, use either a randomly generated locally-administered address, or an address from 00:16:3e:xx:xx:xx — the OUI the Xen Project makes available for exactly this purpose. A random locally-administered address is generally preferable: it has more bits of randomness, so there is less chance of a collision with another host on the same network.

NAT networking¶

As an alternative to bridging, NAT networking routes traffic from guests through dom0. Guests get private IP addresses and share dom0’s public address. This is simpler to set up in some environments but limits direct inbound access to guests.

NAT configuration is handled through dom0’s standard Linux networking tools (iptables/nftables). See your distribution’s documentation for details.

Routing¶

Routing creates a point-to-point link between dom0 and each guest interface, and routes traffic between them using dom0’s normal routing tables — no bridge involved. Because routes are set up per-guest, each interface needs a known, static IP address, configured with the ip= option:

vif = [ "mac=00:16:3e:01:01:01,ip=192.168.1.12" ]

This suits setups where you want tighter control over guest traffic than a bridge gives you, at the cost of needing to manage static addressing yourself.

Open vSwitch¶

Open vSwitch can replace the Linux bridge as the backend for guest networking, and adds software-defined networking features such as VLAN trunking that plain bridging doesn’t support. Set it as the default in xl.conf:

vif.default.script = "vif-openvswitch"
vif.default.bridge = "ovsbr0"

Or specify it per-guest in the vif line with script=vif-openvswitch. To place a guest on a specific VLAN, append it to the bridge name: bridge=xenbr0.102.