Solved vm-bhyve: No network connection from guest

I have two servers, both with identical hardware and software setup (FreeBSD 11, newest patches, used Synth to install vm-bhyve. On both machines I have followed the installation instructions to the letter. On both machines I have one external interface, thus using NAT for bhyve IP addresses. On one machine networking from and to guests works without issues, on one of the machines it does not work.

I have already tried (without success):

- disabling pf
- removing an IP alias (second IP)
- uninstalling vm-bhyve, removing all network interfaces created, reboot, reinstall

I can ping the guest from the host machine but not vice versa. The host cannot even see the gateway.

Any idea what could be amiss? I'm at my wit's end.
 
Can you show us the output of vm switch info <switchname> (replace <switchname> with the name of your virtual switch)?
 
Sure.

Code:
------------------------
Virtual Switch: public
------------------------
  type: auto
  ident: bridge0
  vlan: -
  nat: yes
  physical-ports: -
  bytes-in: 0 (0.000B)
  bytes-out: 0 (0.000B)
 
It looks like your VMs aren't attached to the switch. I've not used NAT before but I would have expected physical-ports to be bound too.

This is what mine looks like (without the NAT):
Code:
root@molly:~ # vm switch info public
------------------------
Virtual Switch: public
------------------------
  type: auto
  ident: bridge0
  vlan: -
  nat: -
  physical-ports: em0
  bytes-in: 368631009 (351.553M)
  bytes-out: 15891494672 (14.800G)

  virtual-port
    device: tap1
    vm: ppttst01

  virtual-port
    device: tap0
    vm: wintermute
As you can see I have two VMs attached to the switch.

Edit: I looked it up but for NAT there should be no physical-port attached:
Code:
             The switch should have no host ports assigned, as these will end
             up on the private side of the NAT network.  vm automatically
             detects the hosts default gateway, which is used as the
             forwarding interface for NAT connections.

But you still need to bind the VMs to the switch.
 
Absolutely. That's what I did. The VMs are using the "public" switch. As originally stated, this approach works on one machine but not on another with identical, hardware, pf rules and OS version. That's why I'm so very much irritated. There's just no VM active at the moment.
 
Make sure you're using the correct addresses. With bridge0 the VMs will be using addresses in 172.16.0.0/24. Also check if /etc/pf.conf has the generated ${VM}/.config/pf-nat.conf included.
 
Here's what I did, several times from scratch, step by step:

Code:
pkg install vm-bhyve
zfs create zroot/vm
sysrc vm_enable="YES"
sysrc vm_dir="zfs:zroot/vm"
vm init
cp /usr/local/share/examples/vm-bhyve/* /zroot/vm/.templates/
vm switch create public
vm switch nat public on
vm iso http://releases.ubuntu.com/16.04.2/ubuntu-16.04.2-server-amd64.iso
vm create -t ubuntu -s 50G testvm
vm [-f] install testvm ubuntu-16.04.2-server-amd64.iso
vm console testvm

Install runs, obviously no DHCP auto configuration, manually set to 172.16.0.2/24, gateway 172.16.0.1. No network connectivity. I manually restarted pf after the new config include is added.

Code:
$ vm switch info
------------------------
Virtual Switch: public
------------------------
  type: auto
  ident: bridge0
  vlan: -
  nat: yes
  physical-ports: -
  bytes-in: 10582 (10.333K)
  bytes-out: 210 (210.000B)

  virtual-port
    device: tap0
    vm: testvm

Here's the files involved:

Code:
$ cat /zroot/vm/testvm/testvm.conf
loader="grub"
cpu=4
memory=2048M
network0_type="virtio-net"
network0_switch="public"
disk0_type="virtio-blk"
disk0_name="disk0.img"
uuid="3366b5df-08d4-11e7-a9e7-448a5b29dff9"

Code:
$ cat /etc/pf.conf
[...]
include "/zroot/vm/.config/pf-nat.conf"
[...]

Code:
$ cat /zroot/vm/.config/pf-nat.conf
# vm-bhyve nat
nat on re0 from {172.16.0.0/24} to any -> (re0)
 
Not sure if it's required but do you have gateway_enable="YES" in rc.conf?
 
No, I don't, as it should not be required. On the first machine it works without that setting.

By the way, net.inet.ip.forwarding is on.
 
By the way, net.inet.ip.forwarding is on.
As far as I'm aware that's pretty much all gateway_enable does.

Disclaimer: even though I wrote vm-bhyve, I heavily dislike using NAT on hypervisors. In my case my guests are either on a real network with a public IP, or on a LAN where they are just bridged to the local ethernet and use the existing router for NAT/DHCP/etc.

Does the bridge have the local IP address set (172.16.0.1) and are you able to ping that from the guest for a start?
Have you tried reducing pf configuration to just the nat rule to see if any firewall rules are causing the issue?
 
I'd also rather not use NAT for this scenario but the two machines being rented servers in a datacenter where I don't have control over the routing, this appears to be the only solution apart from getting separate global IPs for the VM. I'm going to try a very simple pf.conf just to make sure.

Also, why exactly is gateway_enable preferred?
 
I changed the vm switch to not use NAT, allocated a global IP and configured pf with the following parameters:

Code:
ext_if="re0"

set skip on lo

scrub in on $ext_if all fragment reassemble

block in
pass out

pass in on $ext_if proto tcp to ($ext_if) port ssh flags S/SA keep state

Same result: no connectivity. Also, completely disabling pf yields the same result.

For comparison, jails and NAT work fine after re-enabling pf with a different configuration. This is just frustrating.
 
When you're up-and-<not>running in your desired NAT mode, please post the output of:

ifconfig
sysctl net.link.bridge net.link.tap net.inet.ip.forwarding
pfctl -s nat
pfctl -s rules
pfctl -vs Interfaces


Perhaps we'll find something to try...
 
Thanks for bearing wit me. Here you go, public IPs have been obfuscated.

Code:
$ ifconfig
re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE>
        ether 44:8a:5b:29:df:f9
        inet 148.251.x.x netmask 0xffffffe0 broadcast 148.251.x.x
        inet 148.251.x.x netmask 0xfffffff8 broadcast 148.251.x.x
        inet 148.251.x.x netmask 0xfffffff0 broadcast 148.251.x.x
        inet6 fe80::x:x:x:x%re0 prefixlen 64 scopeid 0x1
        nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
        media: Ethernet autoselect (1000baseT <full-duplex,master>)
        status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
        inet 127.0.0.1 netmask 0xff000000
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        groups: lo
pflog0: flags=0<> metric 0 mtu 33160
        groups: pflog
lo1: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
        inet 192.168.0.1 netmask 0xfffffff8
        inet 192.168.0.4 netmask 0xffffffff
        inet 192.168.0.5 netmask 0xffffffff
        inet 192.168.0.6 netmask 0xffffffff
        inet 192.168.0.7 netmask 0xffffffff
        inet 192.168.0.8 netmask 0xffffffff
        inet 192.168.0.3 netmask 0xffffffff
        inet 192.168.0.2 netmask 0xffffffff
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        groups: lo
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        description: vm-public
        ether 02:92:ec:51:5b:00
        inet 172.16.0.1 netmask 0xffffff00 broadcast 172.16.0.255
        nd6 options=1<PERFORMNUD>
        groups: bridge
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: tap0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 6 priority 128 path cost 2000000
tap0: flags=8902<BROADCAST,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        description: vmnet-debian-0-public
        options=80000<LINKSTATE>
        ether 00:bd:78:82:15:00
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect
        status: no carrier
        groups: tap

Code:
$ sysctl net.link.bridge net.link.tap net.inet.ip.forwarding
net.link.bridge.ipfw: 0
net.link.bridge.allow_llz_overlap: 0
net.link.bridge.inherit_mac: 0
net.link.bridge.log_stp: 0
net.link.bridge.pfil_local_phys: 0
net.link.bridge.pfil_member: 1
net.link.bridge.ipfw_arp: 0
net.link.bridge.pfil_bridge: 1
net.link.bridge.pfil_onlyip: 1
net.link.tap.debug: 0
net.link.tap.devfs_cloning: 1
net.link.tap.up_on_open: 1
net.link.tap.user_open: 0
net.inet.ip.forwarding: 1

Code:
$ pfctl -s nat
nat on re0 inet from 172.16.0.0/24 to any -> (re0) round-robin
nat pass on re0 inet from 192.168.0.0/24 to any -> 148.251.x.x
rdr pass on re0 inet proto tcp from any to 148.251.x.x port = 5665 -> 192.168.0.1
rdr pass on re0 inet proto tcp from any to 148.251.x.x port = ssh -> 192.168.0.2

Code:
$ pfctl -s rules
scrub in on re0 all fragment reassemble
block drop in all
pass out all flags S/SA keep state
block drop in quick from <fail2ban> to any
block drop in quick from <badhosts> to any
block drop in quick from <slowqueue> to any probability 97%
pass in on re0 proto tcp from any to (re0) port = ssh flags S/SA keep state (source-track rule, max-src-conn 100, max-src-conn-rate 15/5, overload <abusive_ips> flush, src.track 5)
pass in on re0 proto udp from any to (re0) port = 60000 keep state
pass in on re0 proto udp from any to (re0) port = 60001 keep state
pass in on re0 proto udp from any to (re0) port = 60002 keep state
pass in on re0 proto udp from any to (re0) port = 60003 keep state
pass in on re0 proto udp from any to (re0) port = 60004 keep state
pass in on re0 proto udp from any to (re0) port = 60005 keep state
pass in on re0 proto tcp from any to (re0) port = http flags S/SA keep state
pass in on re0 proto tcp from any to (re0) port = https flags S/SA keep state
pass in on re0 proto tcp from any to (re0) port = 5109 flags S/SA keep state
pass in log on re0 proto tcp from any to (re0) port = smtp flags S/SA keep state
pass out log on re0 proto tcp from (re0) to any port = smtp flags S/SA keep state

Code:
$ pfctl -vs Interfaces
No ALTQ support in kernel
ALTQ related functions disabled
all
bridge
bridge0
lo (skip)
lo0 (skip)
lo1 (skip)
pflog
pflog0
re0
tap
tap0
tap1
tap2
tap50
tap51
tap52
tap53
 
I *think* it may be your block drop in all in pf.conf. You have nothing allowing data to come in on bridge0. On a similar system (laptop running bhyve, using wireless, so with NAT rather than bridged to adapter) I can make things (network access to the outside) stop and start working by using your block drop in all and then adding or commenting out, respectively, a pass in on bridge0 directive after it.

So try that -- either adding a pass in on bridge0 after your block drop in all -- or set skip on bridge0 near the top. If that gets things moving, you can adjust things to your paranoia's requirements.

What is your nat pass on re0 inet from 192.168.0.0/24 to any -> 148.251.x.x line doing for you?
 
Yes, that did the trick! Now I feel a little bit stupid for not realizing it before.

You are a gentlemen and a scholar, sir. Thank you very much for taking the time to look at this.
 
Hey guys, this is a really old post, and sorry if it is against the rule revive a necro post. But, this is the first search link that appears and this thread is really good.
So I have decided to post here to, since my issue is the same and I cant get networking woking on my bhyve. I'll appropriate the troubleshoot that the freebsd wizzards provided here to relate my issue, since it a little diferent but end in the same problem.
So, first off, I've got into Freebsd in the last weekend and I got a very little fresh install FreeBSD as a personal environment. I am using it as a personal PC for study reasons and I plan to stick a little with that OS to learn some of it features, and eventually revive a old computer of mine as a personal server. I don't know if it is important but I am using i3wm as window manager, pkg as the main installer of the tools I am using.
I have instaled bhyve, bhyve-vm, firmware, grub2-bhyve, and everything needed to run a VM. I did got to start my vm, and I am using vncviewer to connect to a archlinux iso that I want to install as a vm for use somethings that are not easily done in freeBSD and other development purposes. I've read some parts of the handbook, wiki and other tutorials.
I've got bhyve working with the quick example at https://wiki.freebsd.org/bhyve,
also I've used https://www.cyberciti.biz/faq/how-to-install-linux-vm-on-freebsd-using-bhyve-and-zfs/ to create a .sh to quickly build a vm without vm-bhyve, and for last,
i'am stickying with this tutorial: https://klarasystems.com/articles/from-0-to-bhyve-on-freebsd-13-1/ that provided a cool template to run a vm with vm-bhyve.
So, in a nutshell, I am using the .template provided by klarasystems to install my vm-bhyve, and I'll post it down here if you guys think that is important and something could be changed (i also got some questions about the arch template that I'll ask here too).

Code:
# If you want to pull a graphical console, you'll need the UEFI loader,
# no matter what OS you're installing on the guest.

loader="uefi"
graphics="yes"
xhci_mouse="yes"

# If not specified, cpu=n will give the guest n discrete CPU sockets.
# This is generally OK for Linux or BSD guests, but Windows throws a fit
# due to licensing issues, so we specify CPU topology manually here.

cpu=2
cpu_sockets=1
cpu_cores=2

# Remember, a guest doesn’t need extra RAM for filesystem caching--
# the host handles that for it. 4G is ludicrously low for Windows on hardware,
# but it’s generally more than sufficient for a guest.
memory=4G

# put up to 8 disks on a single ahci controller. This avoids the creation of
#  a new “controller” on a new “PCIe slot” for each drive added to the guest.

ahci_device_limit="8"

# e1000 works out-of-the-box, but virtio-net performs better. Virtio support
# is built in on FreeBSD and Linux guests, but Windows guests will need
# to have virtio drivers manually installed.

#network0_type="e1000"

network0_type="virtio-net"
network0_switch="public"

 # bhyve/nvme storage is considerably faster than bhyve/virtio-blk
 # storage in my testing, on Windows, Linux, and FreeBSD guests alike.

disk0_type="nvme"
disk0_name="disk0.img"

# This gives the guest a virtual "optical" drive. Specifying disk1_dev=”custom”
# allows us to provide a full path to the ISO.

disk1_type="ahci-cd"
disk1_dev="custom"
disk1_name="/zroot/bhyve/virtio-win.iso"

# windows expects the host to expose localtime by default, not UTC
utctime="no"
Well, he created it for a windowns server, but suits linux and bsd os as well.
I have also, changed the disk1_name to the relative arch.iso I am trying to install and this is the only change I've done to this .template.
You guys can ask me why I didnt use the arch template provided by vm-bhyve, and I've tried with that too, and I'll paste it down here too for some explaining and questioning purposes:
Code:
loader="grub"
cpu=1
memory=512M
network0_type="virtio-net"
network0_switch="public"
disk0_type="virtio-blk"
disk0_name="disk0.img"
grub_install0="linux /arch/boot/x86_64/vmlinuz archisobasedir=arch archisolabel=ARCH_201611 ro"
grub_install1="initrd /arch/boot/x86_64/archiso.img"
When I did run this .template, the grub menu dosent boot automatically to the iso, and also complains that /arch/boot/x86_64/vmlinuz archisobasedir=arch dosen't exists.
I dont think that the templates is the main reasons of my problem, but I didn´t quite understand how those disk1_* and grub_* arguments really work and what they are meant for. If you guys find interesting to talk a little about it, i'll really enjoy that information.
Well, given that, I am building the vm enviroment as the OP did:
Code:
pkg install vm-bhyve
# Well, I haven´t configured zsf pool on my install but i dont think this is the issue.
# zfs create zroot/vm
sysrc vm_enable="YES"
sysrc vm_dir="/my/bhyve/path/"
vm init
cp /usr/local/share/examples/vm-bhyve/* /my/bhyve/path/
vm switch create public
# I've tried that but was it throws a warning and you guys says it's not recommend, I've skipped that
# vm switch nat public on
# I have made that addition, equaling to klarasystems tutorial:
vm switch add public wlan0
vm iso arch.iso
#uefi is the template that i provided you guys up in this post
vm create -t uefi -s 50G testvm
vm [-f] install testvm arch.iso
# instead of vm console, i am using vncviewer, but both ways end in the same problem
vm console testvm
Now, as @SirDice had recomend, my vm switch info public output:

Code:
local: _netgraph,: bad variable name
------------------------
Virtual Switch: public
------------------------
  type: standard
  ident: vm-public
  vlan: -
  physical-ports: wlan0
  bytes-in: 197648 (193.015K)
  bytes-out: 5265452 (5.021M)

thre is that _netgraph issue, i've checked on vm-bhyve git and it is not really a issue I think.
In diference to the OP, I am gotting bytes-in and bytes-out! Also, if I start the vm the output of info is:
Code:
local: _netgraph,: bad variable name
------------------------
Virtual Switch: public
------------------------
  type: standard
  ident: vm-public
  vlan: -
  physical-ports: wlan0
  bytes-in: 201656 (196.929K)
  bytes-out: 5270992 (5.026M)

  virtual-port
    device: tap0
    vm: arch

So the network is really being provided to the vm, I guess.
Now some points that the op had bringed:
- disabling pf
- removing an IP alias (second IP)
- uninstalling vm-bhyve, removing all network interfaces created, reboot, reinstall
I can ping the guest from the host machine but not vice versa. The host cannot even see the gateway.

I don´t have pf installed yet.
I don´t think I have a IP alias (and I guess ifconfig output will confirm that)
I did try unnistall and recreating things, and the situation is really diferent as you guys are seing.
And for last, I tried this ping thing, but I don't know if it really worked out.
(Well, the .template i am using provide the guest at localhost:5900 and pinging it dont really work, how can i know for sure the guest and host IP?)
if the situation is about ping from guest to the inet address provided by ifconfig in my host, when I try that it says:

ping: Connect: Network is unreachable
And maybe that is a issue that I am missing something, Idk for sure!

When op did:
Code:
$ cat /zroot/vm/testvm/testvm.conf
loader="grub"
cpu=4
memory=2048M
network0_type="virtio-net"
network0_switch="public"
disk0_type="virtio-blk"
disk0_name="disk0.img"
uuid="3366b5df-08d4-11e7-a9e7-448a5b29dff9"

I guess it provided to him the template he used, in adition, creating a uuid. My output of that is the same, it provides me a uuid and also a network0_mac.

OP did also a $ cat /etc/pf.conf and a cat /zroot/vm/.config/pf-nat.conf
but again, i haven´t looked into this pf thing yet, so those files dosen't exist in my PC. The guys in thread also talked about gateway_enable="YES" and NAT things but I dont really know what this is about. (yes, I dont know alot of networks, but I hope to get a little better from now on)
Now there is thoose asked outputs:
ifconfig
sysctl net.link.bridge net.link.tap net.inet.ip.forwarding
pfctl -s nat
pfctl -s rules
pfctl -vs Interfaces


Code:
~ > ifconfig                                                                               
wlan0: ..omited...
  
vm-public: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
    ether 36:ae:c9:d3:39:68
    id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
    maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
    root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
    member: tap0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
            ifmaxaddr 0 port 5 priority 128 path cost 2000000
    member: wlan0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
            ifmaxaddr 0 port 2 priority 128 path cost 138888
    groups: bridge vm-switch viid-4c918@
    nd6 options=9<PERFORMNUD,IFDISABLED>
tap0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
    description: vmnet/arch/0/public
    options=80000<LINKSTATE>
    ether 58:9c:fc:10:e5:0c
    groups: tap vm-port
    media: Ethernet autoselect
    status: active
    nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
    Opened by PID 42985


Code:
~ > sysctl net.link.bridge net.link.tap net.inet.ip.forwarding                     
net.link.bridge.ipfw: 0
net.link.bridge.allow_llz_overlap: 0
net.link.bridge.inherit_mac: 0
net.link.bridge.log_stp: 0
net.link.bridge.pfil_local_phys: 0
net.link.bridge.pfil_member: 1
net.link.bridge.ipfw_arp: 0
net.link.bridge.pfil_bridge: 1
net.link.bridge.pfil_onlyip: 1
net.link.tap.debug: 0
net.link.tap.devfs_cloning: 1
net.link.tap.up_on_open: 1
net.link.tap.user_open: 0
net.inet.ip.forwarding: 0


Code:
~ > pfctl -s nat                                                                            
pfctl: /dev/pf: No such file or directory
                                                                                             
~ > pfctl -s rules                                                                          
pfctl: /dev/pf: No such file or directory
                                                                                             
~ > pfctl -vs Interfaces                                                                    
pfctl: /dev/pf: No such file or directory
Well I guess this is it. I dont really know what's goin on or if I just missed some important part of running the bhyve. I just want it for localnetwork purposes. Can you guys please help me? Thanks for reading into here.
 
  • Please start a new post rather than posting onto this old (marked solved) thread.
  • Feel free to include a link to this or other threads for context.
  • I haven't read through your verbose post; consider distilling it down (at least at first) to a concise problem statement; users are more likely to understand what you're facing, and be able to decide if they can help.
 
Back
Top