Dav3

Ok so I ended up back-burnering setting up a virtual switch and defining it in net-define XML. Using iptables in /boot/config/go is good enough for now. Spent far too much time on it. So thanks anyway, that lab-network.xml snippet was really helpful and lead me to the virsh command interface which is a goldmine.

Automating mounting disk images would be a nice addition to a plugin like Unassigned Devices... @dlandon

Great! I'm trying to figure out how to isolate a vm to a few lan addresses & ports, block everything else to them. Been using unraid /boot/config/go file to tweak iptables of br1/eth1 on 2nd nic. Instead I want to define it using 'virsh net-define'. (better) Would prefer to use virtual interface not eth1. To get filtering it needs NAT type (?) Not clear on xml

Apologies for resurrecting an old thread, but this seems relevant enough to avoid creating a duplicate: @ken-ji I've been reading the libvirt Network XML spec but can't figure out how to so something similar to this. I want to create a private bridge that filters a VM to a few addresses & ports on the LAN. My XML currently looks like: <network > <name>private</name> <bridge name="private0" stp="on" delay="0"/> <forward mode="nat" dev="br1"> <nat> <port start='500' end='1000'/> </nat> </forward> <ip address="192.168.1.202" netmask="255.255.255.0"/> </network> But I get an error that br1 is already taken when I try to virsh net-start the XML file. Can anyone provide clues for how to do this?

Hey I just wanted to say thanks for posting this. After trying every permutation of a solution I could think of and in desperation I tried your solution and it works beautifully.