In continuation of NetworkManager management with nmcli, here is a quick Linux console tip for users like CentOS 8 (or all distributions, which use the NetworkManager for managing the networking). How to create a virtualized bridge device MacVTap device with the NetworkManager nmcli command utility, which will preserve all the configuration over reboots.
nmcli connection add type macvlan dev enp0s3 mode bridge tap yes ifname macvtap0 con-name macvtap0 ip4 0.0.0.0/24
The line above creates a virtualized bridged interface and a connection with the name macvtap0. The MAcVTap device with the name macvtap0 is in bridge mode with the physical network interface enp0s3 with manual IP setting. If the IP is not included a DHCP option will be used as default.
There is one big limitation – there is no link between the enp0s3 and macvtap0. When used macvtap0 could receive packets from the network through the enp0s3, but there is no direct link between the two network devices. In simple words, when used in a virtualized environment in a virtual machine the virtual machine may have access to the network shared with the enp0s3, but the virtual machine cannot communicate with the IPs of the enp0s3!
Typically, this is used to make both the guest and the host show up directly on the switch that the host is connected to.
Initial state, only one connection in NetworkManager.
The main server connection with name enp0s3 using the same name network interface enp0s3:
[root@srv ~]# nmcli con
NAME UUID TYPE DEVICE
enp0s3 09497bbf-da59-42b7-a72c-d69369760b36 ethernet enp0s3
[root@srv ~]# nmcli
enp0s3: connected to enp0s3
"Intel 82540EM"
ethernet (e1000), 08:00:27:03:C9:2E, hw, mtu 1500
ip4 default
inet4 192.168.0.20/24
route4 192.168.0.0/24 metric 100
route4 0.0.0.0/0 via 192.168.0.1 metric 100
inet6 fe80::a00:27ff:fe03:c92e/64
route6 fe80::/64 metric 100
lo: unmanaged
"lo"
loopback (unknown), 00:00:00:00:00:00, sw, mtu 65536
DNS configuration:
servers: 8.8.8.8 1.1.1.1
interface: enp0s3
Use "nmcli device show" to get complete information about known devices and
"nmcli connection show" to get an overview on active connection profiles.
Consult nmcli(1) and nmcli-examples(7) manual pages for complete usage details.
Add the MacVTap device with the name macvlan0
[root@srv ~]# nmcli connection add type macvlan dev enp0s3 mode bridge tap yes ifname macvtap0 con-name macvtap0 ip4 0.0.0.0/24 Connection 'macvtap0' (7a5ef04c-ea98-4642-ac5d-4239f715f631) successfully added.
A MacVTap device, a network connection, and a link are established. The name of the MacVTap device and the network connection is macvtap0.
The NetworkManager connections after creating the new macvtap0 device.
[root@srv ~]# nmcli con
NAME UUID TYPE DEVICE
enp0s3 09497bbf-da59-42b7-a72c-d69369760b36 ethernet enp0s3
macvtap0 7a5ef04c-ea98-4642-ac5d-4239f715f631 macvlan macvtap0
[root@srv ~]# nmcli
enp0s3: connected to enp0s3
"Intel 82540EM"
ethernet (e1000), 08:00:27:03:C9:2E, hw, mtu 1500
ip4 default
inet4 192.168.0.20/24
route4 192.168.0.0/24 metric 100
route4 0.0.0.0/0 via 192.168.0.1 metric 100
inet6 fe80::a00:27ff:fe03:c92e/64
route6 fe80::/64 metric 100
macvtap0: connected to macvtap0
"macvtap0"
macvlan (macvtap), 4E:C5:22:48:4E:E6, sw, mtu 1500
inet4 0.0.0.0/24
inet6 fe80::8395:caa6:2773:df72/64
route6 fe80::/64 metric 410
lo: unmanaged
"lo"
loopback (unknown), 00:00:00:00:00:00, sw, mtu 65536
DNS configuration:
servers: 8.8.8.8 1.1.1.1
interface: enp0s3
Use "nmcli device show" to get complete information about known devices and
"nmcli connection show" to get an overview on active connection profiles.
Consult nmcli(1) and nmcli-examples(7) manual pages for complete usage details.
As mentioned above, if the macvtap0 is intended to be used as a local bridge with the NAT (masquerade) through the main interface, it is impossible, because there is no link with the main interface IPs, which are needed to be a gateway of the macvtap0. Still, the macvtap0 could be used to take part in a virtual device (in a virtual/container machine, for example), which has a real Internet IP or local IP and NAT/DHCP from a remote server through the shared network of enp0s3. The MAC address of macvtap0 are visible through the enp0s3‘s network.
On the contrary with the real bridge setup shown here – Create bridge and add TUN/TAP device using NetworkManager nmcli under CentOS 8, the bridge is isolated and the MAC of the TUN/TAP device across not visible in the network.
*Note) macvtap kernel module
The nmcli line with macvtap device will trigger a kernel module of macvtap to be autoloaded in the system, so need to load it first under CentOS 8/Stream 8.
I believe you are missing key points about the flexability of macvtap/lan. further increasing the static of bad information:
man ip-link
mode { private | vepa | bridge | passthru }
(applicable to both tap and lan)
nmcli
type: ‘macvtap’ not among [6lowpan, 802-11-olpc-mesh (olpc-mesh), 802-11-wireless (wifi), 802-3-ethernet (ethernet), adsl, bluetooth, bond, bridge, cdma, dummy, generic, gsm, infiniband, ip-tunnel, macsec, macvlan, ovs-bridge, ovs-dpdk, ovs-interface, ovs-patch, ovs-port, pppoe, team, tun, veth, vlan, vpn, vrf, vxlan, wifi-p2p, wimax, wireguard, wpan, bond-slave, bridge-slave, team-slave]
kernel depending, but since you are lacking basics, I would guess your readers are as well.
nmcli con add type macvlan dev foo mode
Error: value for ‘mode’ is missing.
Do your homework
Probably, you missed the point with the fact the above lines worked and still work pretty well under Cent OS 8/Stream 8 clearly stating the Linux distribution in several places including the URL and the article’s title. Can you decrease the static of bad information by providing your Linux distribution, because otherwise, your comment is useless and will be deleted if not? This site tries showing practical examples from the real world and it does not pretend to be comprehensive and detailed as the official documentation should be (unfortunately, this just may get the documentation to the unreadable state way too often lately!)