Windows 10: Enable Windows VM's HOST access with KVM HOSTS

Hi folks

If you are playing around with KVM Hosts and want Windows VM's to have host access without going through all problems of creating bridges (not supported via KVM on WIFI anyway) here's a simple way to do it : The method works by defining a "Virtual network" and a virtual NIC card (NIC - Network Interface Card for those who don't know)

(Note I've assumed you've been able to create your Windows Virtual Machine BTW).


1) create an Isolated network on the Host say in /tmp/isolated.xml (XML file) -- give it a fixed IP address e.g as shown.

<network>
<name>isolated</name>
<ip address="192.168.254.1" netmask="255.255.255.0"> ===== Your VM will use this addr 192.168.254.1 for accessing the Host
<dhcp>
<range start="192.168.254.2" end="192.168.254.254"/>
</dhcp>
</ip>
</network>

2) define it via virsh net-define
[email protected] hrafn]# virsh net-define /tmp/isolated.xml you should see response : Network isolated defined from /tmp/isolated.xml


3)auto start it and also start it (virsh-net start)
[[email protected] hrafn]# virsh net-autostart isolated response from console should be : Network isolated marked as autostarted

4) in the Virtual Machines configuration :
a) Ist Nic define as Host device <nic interface e'g ethx or empxx or whatever>:macvtap source mode bridge

b) add in the VM a second NIC defined as Virtual network <name --in my case isolated> device model virtio

5) start guest

6) Host will be accessible always as 192.168.254.1

Works fine for Windows VM's on Arch and Fedora. Should also work if the real NIC is a wifi card too. Should also work on any other Linux distro that supports KVM/QEMU Virtual Machines e.g OPENSUSE / LINUX MINT / UBUNTU/DEBIAN.

The XML generated file will look something like this for NIC 2 --depending on your hardware --this is generated automatically if everything is setup correctly.

<interface type="network">
<mac address="52:54:00:b0:3c:94"/>
<source network="isolated" portid="4afe495d-53a4-49fa-84e1-85d5c658bf78" bridge="virbr0"/>
<target dev="vnet0"/>
<model type="virtio"/>
<alias name="net0"/>
<address type="pci" domain="0x0000" bus="0x01" slot="0x00" function="0x0"/>
</interface>

If you've done it correctly you should see as the output on the host of ifconfig (or equivalent command) the network virbr1 at the bottom of the screenshot with IP address 192.168.254.1 which is what the Windows VM will use to access the Host. (Note the VM can access other machines on Lan / Internet in the normal way - this is only for the VM to get HOST access).






Have fun !!!!

Cheers
jimbo

:)

 

Networking on Windows VM from KVM/ QEMU Host via Bridge

Hi folks

For those running Windows VM's on Linux Hosts and want to try the Linux Hypervisor (VMWare and VBOX will run concurrently so you don't even need to power off any running Windows VM's) with decent networking you need to set up a network Bridge (roughly analogous to External Switch in HYPER-V). Otherwise the VM will have access to the Internet only and other parts of your LAN but no host access either way -- either from HOST TO VM or from VM to HOST.

I've assumed you've already installed basic networking and managed to create a Virtual Machine . (You can create the bridge of course before creating the Virtual Machine to test if it's working properly).

1) On the HOST install bridge-utils
2) Create the bridge -- this is done with a simple file in /etc/netctl directory -- my example is kvm-bridge
3) here's the simplest possible file . If you don't like the basic vi editor (ugh !!!!) you can use a wysisyg full screen editor e.g kate that allows root save to root access only folders.

Interface=br0
Connection=bridge
BindsToInterfaces=(enp2s0f1) ===>to a physical device in your system --
IP=dhcp

4) start the bridge : netctl start kvm-bridge

5) automatically start at Host boot

netctl enable kvm-bridge

6) Check via any command if interfaces all working (via ifconfig or any appropriate command). To display the bridge use the command brctl show.

7) In Samba add these two lines to /etc/samba.conf file

bind interfaces only = yes
interfaces = br0 >>>>> Name of your bridge

If you don't do this on the HOST (only) the host will not have any access to any VM's on the LAN whatever host they are attached to -- even those on different physical machines - it will still be able to access physical machines and the Internet though.

8) in the VM config for windows (Easy GUI is to use lib-virt - Virtual machine manager) create virtual network --- specify network source -- etc as shown (for Virtio install the win-virtio drivers otherwise a physical nic card will come up - can be used also but virtio is streets ahead for better for Windows)





9) Now your VM has full network access





10 ) And from the HOST (Hestur) -- the 2nd VM is a VMWare W10 VM on a different host (wulf) not running KVM.





Job Done "Seeemples" !!!


enjoy !!!! ( it's a lot more fun than just starting up VMWare player !!!!!)


Cheers

jimbo

 

KVM Virtual Machines -- Host access from the VM

Hi there

Don't do this on a LIVE distro though as these aren't persistent so you won't be able to save changes !!!!

A good way of playing with this stuff without touching any Internal HDD's is to install the Linux system on an external HDD (SSD is better) connected via USB3-->SATA to computer -- response time is perfectly good enough even for the VM !!) -- This way it won't mess up any boot records on the HDD.

For people using KVM/QEMU for creating VM's there's often a problem with the Virtual Machine's being able to access the HOST (the VM's can access Internet and other machines on your LAN OK of course).

(I assume you've installed KVM/QEMU etc and know how to create a basic Virtual Machine first. - There's loads of info in the internet on how to do that if you aren't sure)

The usual way around that is to create a Bridge which can be fiddly and currently these often don't work on a lot of Wireless NIC's

So the easiest way is to create a separated "isolated" network and use 2 Virtual NIC's

1) create an Isolated network on the Host say in any directory for example /tmp/isolated.xml (XML file) and give it a fixed IP address e.g as shown. (Use any decent text editor to create the XML file - you don't need a special XML editor --Windows Notepad is fine too.)

In the example I've defined my network with the name isolated and the file is on /tmp.isolated.xml (note to create an empty file in Linux simply use the command touch e.g touch /tmp/isolated.xml - now you can edit it).

<network>
<name>isolated</name>
<ip address="192.168.254.1" netmask="255.255.255.0">
<dhcp>
<range start="192.168.254.2" end="192.168.254.254"/>
</dhcp>
</ip>
</network>

2) Define it to the Host system : sudo virsh net-define /tmp/isolated.xml
3) Start it : sudo virsh net-start isolated
4) to start automatically at HOST boot : sudo virsh net-autostart isolated
you should see console message : Network isolated marked as autostarted
5) restart the libvirtd service. (sudo systemctl restart libvirtd) -- to automatically start the libvirtd service at HOST boot : sudo systemctl enable libvirtd)
6)Now for the NICS for the VM in the VM config file -- nic 1 as <nic inteface e.g ethx or empxx or whatever>:macvtap source mode bridge, and the second one as Virtual network <name --in my case isolated> device model virtio -- you can use any hardware for the model - I'm using the paravirtualised stuff for windows VM's on the downloadable winvirtio iso from fedora site -- works with other distros without issue.

7) start guest -- For guest access to the HOST the address will be fixed at 192.168.254.1 (note that's not the HOST's real IP address which is accessible as normal by rest of your LAN).





The XML file will look something like this for NIC 2 --depending on your hardware - it's automatically generated after you've defined the basic setup/

<interface type="network">
<mac address="52:54:00:b0:3c:94"/>
<source network="isolated" portid="4afe495d-53a4-49fa-84e1-85d5c658bf78" bridge="virbr0"/>
<target dev="vnet0"/>
<model type="virtio"/>
<alias name="net0"/>
<address type="pci" domain="0x0000" bus="0x01" slot="0x00" function="0x0"/>
</interface>

To RDP (From another computer on your lan) to the Windows VM the HOSTNAME of the Windows machine should work properly --it does BTW on my systems--if not (then there's something wrong with name resolution) then use the IP address that's on the same subnet as your Lan --in this case the first IP address here





Works on Wifi cards as well if you want to mess about with this stuff on a Laptop !!!! - Always backup a Main Windows image though if installing a linux distro on your main Windows machine so you can restore again. Probably the best way to test this is to install the Linux system to external SSD/HDD rather than Dual boot -- remember though to allow enough HDD space for the Windows VM -- the actual Linux distro will sit quite happily with 10 - 20 GB depending on what you install.


Cheers
jimbo

 

Account failed logon 4625 on VM guest when clicking the entry of VM guest on failover cluster Manager on VM Host

Issue:

We found a multiple failed logon events on VM guest (evert ID 4625) with account (the account you logon on VM host) when we clicking the entry of VM guest on failover cluster manager console on VM host with Integration servers (Data Exchange) is enabled.



How to reproduce:

1. Check the “Data Exchange” is enabled on a VM guest (Enabled by default, right?)
2. Open Failover Cluster Manager Console on VM host.
3. Click the VM guest entry
4. Then you may found multiple failed logon events on that VM guest.

Reference:

Hyper-V Integration Services



Question:

1. Does the multiple failed logons are normal or necessary?
2. If the failed logons are normal and necessary to be happened and the “Data exchange” function is good to be enabled to gather data from VM guest, any recommendation for us to correct or avoid these failed logon?

Please advise.



Constrain:

We have no chance to use same account and password on VM hosts and VM guests (because all account are managed by password management) and the Audit Policy of Audit Credential Validation must be enabled.