On 05/26/2015 09:00 AM, Giovanni Tirloni wrote: You are misunderstanding the forward dev attribute (which is really very common :-) as well as the 'route' mode. * When forward mode is 'route' or 'nat', or there is no <forward> element at all, libvirt will create a bridge that has no directly attached physical interfaces. Any traffic forwarded off of this bridge onto the physical network must be forwarded by the host's IP routing. * the forward 'dev' attribute doesn't attach any physical device to the bridge, and doesn't change any routing on the host either. All that it does is add iptables rules that will reject any traffic from the bridge that is forwarded to an interface other than the one given in 'dev'. (This might be useful if you have a host with multiple ethernet interfaces, perhaps one onto a private net and another onto a public net, and you wanted to make sure your guests were not able to reach the private net. Personally, I have never had a problem that it solved, so I never set the forward dev for routed/nated networks). Since you want to have an ethernet directly attached to your bridge, I'm guessing that you don't really want a routed network anyway, but that you instead want what is usually called a "bridged network". This is where the guests are all in the same L2 broadcast domain as the physical network. If that is what you want, then the way to achieve it is by creating a bridge that is attached to the host's ethernet in the host's system network config (outside of libvirt): http://wiki.libvirt.org/page/Networking#Bridged_networking_.28aka_.22shar... ( http://tinyurl.com/m3smxn in case that long link is broken up) (on Fedora/RHEL/CentOS you may be able to do this with "virsh iface-bridge eth0 br0", but you will want to first run "virsh iface-begin", be sure that you have alternate access to the host, then later run "virsh iface-commit" only if the bridge is successfully created; otherwise reboot the host and the original network config will be restored) After you have a bridge device created, you can either reference it directly in your guest domain config with <interface type='bridge'>, or optionally create an unmanaged libvirt network that points to it and continue to use <interface type='network'>, e.g.: <network> <name>bridge-net</name> <bridge name='br0'/> <forward mode='bridge'/> </network>