KVM network scripts

While tools such as virt-manager and virsh are useful, not all of the features of kvm are available with these front ends.

There are a rich number of options with KVM and I would encourage you to read man qemu if you are interested in learning more. I may blog with a few that I use often, but will save that for another day.

If you run kvm from the command line the default networking is NAT, the same defaults as virt-manager.

When I use bridged networking, I found few “simple” scripts to automate the process of bringing a tap devices up/down. With this technique, my router to performs DNS for the guests.

There are 3 scripts, all run on the host to automate the process of bringing a tap interface up and down “automagically” when you start a guest.

1. /etc/qemu-ifup => Adds a tap to an existing bridge when the guest starts.
2. /etc/qeum-ifdown => Removes a tap when the guest exits.
3. kvm wrapper scriptThis third script is a wrapper script for kvm (you can not directly use a tap, see quem documentation for details).


Set up is fairly minimal, start by installingtunctl.

  • If you are using a wired network, set up your bridge as in my initial post here :
    Virt Manager bridged networking
  • If you are using wireless, I have had success withparprouted (wireless will be my next blog entry).

Next, using any method, add a group “kvm” to your system and add your user to this group. Log off and back on to enable this change.

Now make a few changes to a few system settings. Basically we are changing permissions of /dev/kvm and /dev/net/tun so that you may access them as an member of the kvm group (and not root). I add these changes to /etc/rc.local.

/bin/chown root.kvm /dev/kvm
/bin/chown -R root.kvm /dev/net
/bin/chmod -R 660 /dev/net

Although I run kvm in user space (as a non-root user), a few commands need to be run as root. Perfect task for sudo (yes you can use sudo in Debian and Fedora, and this is a great example of using sudo).

You will need to edit /etc/sudoers, I strongly suggest you use visudo as it will check your syntax.

If you are not comfortable with vi, use nano:

export EDITOR=’/usr/bin/nano -w’
sudo -E visudo

I suggest using a command alias for kvm :

## KVM
Cmnd_Alias KVM = /usr/sbin/tunctl, /sbin/ifconfig, /usr/sbin/brctl, /sbin/ip

And now allow users in the kvm group to run those commands as root without a password (add these lines lower in the file , under the group section).


KVM Wrapper script

This wrapper script will run your kvm guest and call /etc/qemu-ifup and /etc/qemu-ifdown to configure a tap device. I personally save the script in ~/bin/kvm-bridge .

#!/usr/bin/env bash
# tap interface automagic allocation
# for linux kernels >= 2.6.18

# modified by bodhi.zazen from :
# http://calamari.reverse-dns.net:980/cgi-bin/moin.cgi/FrequentlyAskedQuestions

# set up a tap interface for qemu/kvm
# USERID – uid qemu is being run under.

# generate a random mac address for use the virtual nic
# With thanks to pheldens @ qemu forum

ranmac=$(echo -n DE:AD:BE:EF ; for i in `seq 1 2` ; \
do echo -n `echo “:$RANDOM$RANDOM” | cut -n -c -3` ;done)

# specify which NIC to use – see man qemu

# The iface variable is automatically set to the next available tap
# Numbering starts with tap0
iface=`sudo tunctl -b -u $USERID`

# start kvm with our parameters
# $@ allows us to add additional command like parameters
# such as -hda $HOME/ubuntu.qcow2
echo “Bringing up interface $iface with mac address $ranmac”
# For Fedora 11 change “kvm” to “qemu-kvm”
kvm -net nic,vlan=0,macaddr=$ranmac,model=$model -net tap,vlan=0,ifname=$iface -usb -usbdevice tablet $@

/usr/bin/sudo /usr/sbin/tunctl -d $iface

User the wrapper script as you would use kvm, including any options you wish to specify on the command line. You do not need to specify networking options.

Example 1.

kvm-bridge -cdrom ~/ubuntu-9.04-desktop.iso -m 512 -hda ~/ubuntu-9.04.qcow2


So the guest does not crash if X crashes , I call the script with screen and specify a vnc output (connect to guest with a vnc viewer).

screen -d -m -S guest_name kvm-bridge -hda /home/user_name/ubuntu.qcow2 -vnc :0

Use these 2 scripts for /etc/qemu-ifup and /etc/qemu-ifdown . Although it may not be clear from the qemu / kvm documentation, these two scripts in these (default) locations are run automatically when you start qemu/kvm with the-net tap flag. You may specify a different location for these scripts if you choose.

Note: I have had reports that some people using Ubuntu have had to move these scripts to

Thank you for the info Tomy

/etc/qemu-ifup :

# Bring a tap interface up
set -x

if [ -n “$1” ];then
/usr/bin/sudo /usr/sbin/tunctl -u user -g kvm -t $1
/usr/bin/sudo /sbin/ip link set $1 up
sleep 0.5s
/usr/bin/sudo /usr/sbin/brctl addif br0 $1
exit 0
echo “Error: no interface specified”
exit 1

Note: Change “user” in “/usr/bin/sudo /usr/sbin/tunctl -u user -g kvm -t $1” to your log in name.

Note: The option “-g kvm” in the command “/usr/bin/sudo /usr/sbin/tunctl -u user -g kvm -t $1” can cause permission problems if your primary group is not kvm, consider removing it or changing your primary group.

usermod -g kvm user

You will need to log off and back on after changing your primary group.


# Take the tap interface down.
/usr/bin/sudo /usr/sbin/brctl delif br0 $1
/usr/bin/sudo /sbin/ifconfig $1 down
/usr/bin/sudo /usr/sbin/tunctl -d $1

Set ownership and permissions :

sudo chown root.kvm /etc/qemu-if*
sudo chmod 550 /etc/qemu-if*


This entry was posted in Linux. Bookmark the permalink.

18 Responses to KVM network scripts

  1. Shaun Dennie says:



  2. bodhi.zazen says:

    VDE is nice. FYI VDE is built into virt-manager and VDE does not provide a bridged network connection.

    for additional information on VDE, I found this to be helpful :


  3. Pingback: Shadows of epiphany » Blog Archive » KVM network scripts | networking-the.info

  4. Michael says:

    Unfortunately under Fedora 11 I keep getting the error:
    TUNSETIFF: Device or resource busy

    $kvm-bridge -m 512 -drive file=/var/lib/libvirt/images/Ubuntu.img
    Bringing up interface tap5 with mac address DE:AD:BE:EF:10:14
    + ‘[‘ -n tap5 ‘]’
    + /usr/bin/sudo /usr/sbin/tunctl -u michael -g kvm -t tap5
    TUNSETIFF: Device or resource busy
    + /usr/bin/sudo /sbin/ip link set tap5 up
    + sleep 0.5s
    + /usr/bin/sudo /usr/sbin/brctl addif br0 tap5
    + exit 0
    qemu: could not open disk image /var/lib/libvirt/images/Ubuntu.img

    Any ideas?
    my username is michael

    groups output give:
    michael ecryptfs vboxusers kvm

    stat /dev/kvm
    File: ‘/dev/kvm’
    Size: 0 Blocks: 0 IO Block: 4096 byte-apparaat
    Device: fh/15d Inode: 7974 Links: 1 Device type: a,e8
    Access: (0660/crw-rw—-) Uid: ( 0/ root) Gid: ( 503/ kvm)
    Access: 2009-07-02 19:15:44.443862986 +0200
    Modify: 2009-07-02 19:15:44.443862986 +0200
    Change: 2009-07-02 19:26:22.007465932 +0200


  5. Michael says:

    Extra Inf:
    As root I got the same error, but the VM seems to run without problems, network is bridged.
    What me surprise is that the bridge module NOT is loaded when you execute the
    lsmod|grep bridge command.
    Output gives:
    bridge 41488 0
    stp 1944 1 bridge
    llc 4780 2 bridge,stp
    Only the stp and llc seems to be loaded.

    This is also this when using bridge networking with virt-manager
    Also with virt-manager I have a perfect working bridge network (without the bridge module loaded).

  6. Michael says:

    all seems to work now (also as normal user) except for the TUNSETIFF: Device or resource busy message.


  7. bodhi.zazen says:

    1. Try removing the “-g kvm”

    from the /etc/qemu-ifup script, line

    “/usr/bin/sudo /usr/sbin/tunctl -u user -g kvm -t $1”

    /usr/bin/sudo /usr/sbin/tunctl -u user -t $1

    2. Make sure on the same line, “-u user” is your user name (and not “user”).

  8. Michael says:

    Thanks for sharing this info.
    Unfortunately the error message keeps coming. The rest seems to work very well. That’s the most important for me. Thanks for this blog.
    Redirecting the error message to /dev/null and all problems seems to be solved :-)

  9. Master One says:

    bodhi.zazen, the info, that “VDE is built into virt-manager” can’t be right, because virt-manager depends on libvirt, and VDE is still not supported by libvirt.

    VDE (to be precisely VDE2) is the superior way to get it all connected, and it is indeed already supported by QEMU/KVM, but unfortunately not by any of the management tools, that rely on libvirt.

    There is very little up-to-date info available, and I am just trying to clue all pieces together, seems I have to go for kvm without libvirt, because I really don’t want to miss VDE (and during my tests I didn’t like it, when libvirt messed around with my iptables setup).

    If anybody has some more info on that topic, or links to up-to-date tutorials, please tell.

  10. bodhi.zazen says:

    @Master One – Well, I mis-spoke, not VDE, but VDE functionality.

    You are correct in that the term “KVM” is confusing as there are several front ends for KVM from libvirt to virsh to virt-manager to web based interfaces.

    Personally I prefer to run KVM directly, from the command line, with a few scripts.

    virt-manager is highly variable, IMO, in terms of functionality across distros and versions (virt-manager is not the same on Ubuntu vs Fedora for example).

  11. pgreenwood says:

    This seems to be the best resource around for what I’m looking for — to easily and repeatedly launch a VM in Debian squeeze/sid 2.6.30-2-amd64 with networking and sound. virt-manager consistently provides networking without sound; the command line consistently provides sound without networking. Running this command ~# kvm -m 2048 -no-frame -net tap,script=/etc/kvm/kvm-ifup -soundhw all -hda /home/pat/vista.qcow — the error I get is:
    device eth2 is already a member of a bridge; can’t enslave it to bridge br0.
    /etc/kvm/kvm-ifdown: could not launch network script.

    I’ll be testing-out these scripts and report back.

  12. Noah says:

    The following might help tell you why you cannot delete a tun interface using ‘tunctl -d’:

    lsof /dev/net/tun

  13. Pingback: Using KVM public bridge manually

  14. Pingback: Using KVM public bridge manually | Forge network

  15. Pingback: = Manually setup KVM public bridge « SF-Xpt's Blog

  16. Pingback: Virtual Machine Manager - Screen resolution

  17. Robert says:

    In a Red Hat-based distribution (ie. CentOS or Scientific Linux), it apearps that KSM can be turned off like so:$ sudo /bin/su -c for service in ksm ksmtuned; do service $service stop; chkconfig $service off; done’

Leave a Reply

Your email address will not be published. Required fields are marked *