To work with KVM VM's in Fedora 30 I need to set up bridge connection. So I managed to write some simple script, but seems i have some issue. If i am correct, then properties i entered for bridge connection are not passed to Ethernet connection when i add bridge-slave connection? Could you please give me a hint on my issue in this script file? This is my ./bridge.sh script:


# Author: Dzintars Klavins
# This script will setup bridge connection to enable KVM networking
# Before runing, delete all devices and connections
# nmcli connection delete <connection-name>
# nmcli device delete <device-name>
# Don't forget to make this file executable


# General cleanup

# Delete all existing connections
for i in `nmcli c | \
grep -o -- "[0-9a-fA-F]\{8\}-[0-9a-fA-F]\{4\}-[0-9a-fA-F]\{4\}-[0-9a-fA-F]\{4\}-[0-9a-fA-F]\{12\}"` ; \
do nmcli connection delete uuid $i ; \

# Delete all devices (optional/not sure)
for i in `nmcli d | \
grep -o -- "[0-9a-fA-F]\{8\}-[0-9a-fA-F]\{4\}-[0-9a-fA-F]\{4\}-[0-9a-fA-F]\{4\}-[0-9a-fA-F]\{12\}"` ; \
do nmcli device delete uuid $i ; \

# Create new bridge connection
nmcli connection add type bridge autoconnect yes con-name ${NETWORK_BRIDGE_CONNECTION} ifname ${NETWORK_BRIDGE_CONNECTION}
# Modify bridge connection properties
nmcli connection modify ${NETWORK_BRIDGE_CONNECTION} ipv4.address ${NETWORK_IP_ADDRESS}/24
nmcli connection modify ${NETWORK_BRIDGE_CONNECTION} ipv4.method manual
nmcli connection modify ${NETWORK_BRIDGE_CONNECTION} ipv4.gateway ${NETWORK_GW_ADDRESS}
nmcli connection modify ${NETWORK_BRIDGE_CONNECTION} ipv4.dns ${NETWORK_DNS_ADDRESES}
# Bring bridged connection up
nmcli connection up ${NETWORK_BRIDGE_CONNECTION}
# Add slave for bridged connection
nmcli connection add type bridge-slave autoconnect yes con-name ${NETWORK_ETHERNET_CONNECTION} ifname ${NETWORK_ETHERNET_DEVICE} master ${NETWORK_BRIDGE_CONNECTION}
# Bring up slave connection
nmcli connection down ${NETWORK_ETHERNET_CONNECTION}; nmcli connection up ${NETWORK_ETHERNET_CONNECTION}

ping google.com
# ... no ping :( :( :(

It kinda works, but it doesn't ping google. I see 2 devices created:

$ nmcli device
br1         bridge    connected    br1        
eno1        ethernet  connected    eno1       
wlp6s0u1    wifi      unavailable  --         
lo          loopback  unmanaged    --         
virbr0-nic  tun       unmanaged    --   

And 2 connections as well:

$ nmcli connection
NAME  UUID                                  TYPE      DEVICE 
br1   7ed7ca67-8a92-4ba4-a526-092efbf6c4ea  bridge    br1    
eno1  00b1f26a-c83e-46eb-a432-aa749f798d08  ethernet  eno1

Output of ip addr:

$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br1 state UP group default qlen 1000
    link/ether 30:85:a9:96:49:ef brd ff:ff:ff:ff:ff:ff
8: wlp6s0u1: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 7e:fd:21:9f:4f:03 brd ff:ff:ff:ff:ff:ff
50: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether 52:54:00:b6:5f:4f brd ff:ff:ff:ff:ff:ff
73: br1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 30:85:a9:96:49:ef brd ff:ff:ff:ff:ff:ff
    inet brd scope global noprefixroute br1
       valid_lft forever preferred_lft forever
    inet6 fe80::b71a:aa17:83b:f53/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
  • UPD. IIRC this script worked. The issue was that I just need to wait a little bit 20-60 secs and then Ping works as expected.
    – Dzintars
    Sep 28, 2020 at 20:13

1 Answer 1


I assume your ping from kvm client s not getting through the bridge, but ping at host is ok.

I have the same problem setting up bridging for kvm. I listed the iptables rules and noticed firewalld setup (Fedora 30/31) is missing final ACCEPT of forward chain in default zone bridge interface. The final ACCEPTs are in FWDI_libvirt and FWDO_libvirt tables.

So, either change default zone for your bridge interface to libvirt and enable services in libvirt, or append the forward rules for your default zone. Assuming your bridge interface br0 or br1 default zone is "public", do this (change public to whatever zone necessary):

# firewall-cmd --permanent --direct --add-passthrough ipv4 -A FWDI_public -j ACCEPT
# firewall-cmd --permanent --direct --add-passthrough ipv4 -A FWDO_public -j ACCEPT
# firewall-cmd --reload

These direct iptables rules will be added in /etc/firewalld/direct.xml

Another way is to forward all incoming and outgoing packets for br0 or br1

# firewall-cmd --permanent --direct --add-passthrough ipv4 -A FORWARD -i br0 -j ACCEPT
# firewall-cmd --permanent --direct --add-passthrough ipv4 -A FORWARD -o br0 -j ACCEPT
# firewall-cmd --reload

Hope this helps.

  • omg you just saved my butt. I was having issues getting the libvirtio interface to connect with my machines and nothing was working. thank you so much!
    – xR34P3Rx
    Apr 6, 2021 at 14:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .