There seems to be a lot on this topic already, so apologies for adding to a sea of information, but I have not had luck in finding anything that seems to address my scenario.

My guest cannot ping my default gateway, but my host can ping my default gateway.

I have a KVM host (CentOS7) with a bridge interface configured, 'ip a':

2: eno16777984: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master virbr0 state UP qlen 1000
    link/ether 00:0c:29:80:14:0a brd ff:ff:ff:ff:ff:ff
    inet6 fe80::20c:29ff:fe80:140a/64 scope link
       valid_lft forever preferred_lft forever
3: virbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    link/ether 00:0c:29:80:14:0a brd ff:ff:ff:ff:ff:ff
    inet brd scope global virbr0
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe80:140a/64 scope link
       valid_lft forever preferred_lft forever
12: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master virbr0 state UNKNOWN qlen 500
    link/ether fe:54:00:a0:02:d5 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::fc54:ff:fea0:2d5/64 scope link
       valid_lft forever preferred_lft forever

Now the interesting part, my guest receives a valid DHCP lease from my DHCP server. My guest can ping the host's ip address and the host can ping the guest's ip address. I attempted stopping firewalld to resolve the issue, but that did not resolve the issue, and I suspect the issue isn't that high in the stack, since DHCP worked. If I ping the guest from another network device, the requests time out, but an entry for the device is added to the guests arp table, and the device initiating the ping.

My thought is my bridge is configured improperly but I am uncertain what would cause only some traffic to fail.

Here is my interface configuration for reference:

[root@kvm01 ~]# cat /etc/sysctl.d/99-ipforward.conf
net.ipv4.ip_forward = 1
[root@kvm01 ~]# cat /etc/sysconfig/network-scripts/ifcfg-eno16777984
[root@kvm01 ~]# cat /etc/sysconfig/network-scripts/ifcfg-virbr0
[root@kvm01 ~]#

1 Answer 1


Sometimes I am not the most comprehensive thinker. ARPs are working fine, that means that layer 2 is good. What do you test after layer 2? Well, layer 3 of course. The hosts on the physical network had no route back to the guests.

Since the host is effectively functioning as a router for the guests, any ip traffic would be sent from the guest with no issue, but would never get a response since the recipient would not have a route to that IP through the host.

I added a static network to my test machine on the physical network for my guests IP with a gateway of the host and pings started working fine.

The solution is to simply put the guests on a disjoint layer 2 network, then have the router on my physical network have a route to the guest's network via the host. That will resolve my issue.

The following libvirt documentation describes the options for KVM networking relatively well. The only exceptions, not documented here, would be using Cisco Nexus 1000v or Open vSwitch.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .