B.9. Guest Can Reach Outside Network, but Cannot Reach Host when Using macvtap Interface

Procedure B.3. Creating an isolated network with libvirt

1. Add and save the following XML in the /tmp/isolated.xml file. If the 192.168.254.0/24 network is already in use elsewhere on your network, you can choose a different network.

   <network>
     <name>isolated</name>
     <ip address='192.168.254.1' netmask='255.255.255.0'>
       <dhcp>
         <range start='192.168.254.2' end='192.168.254.254' />
       </dhcp>
     </ip>
   </network>

2. Create the network with this command: virsh net-define /tmp/isolated.xml
3. Set the network to autostart with the virsh net-autostart isolated command.
4. Start the network with the virsh net-start isolated command.
5. Using virsh edit name_of_guest, edit the configuration of each guest that uses macvtap for its network connection and add a new <interface> in the <devices> section similar to the following (note the <model type='virtio'/> line is optional to include):

   <interface type='network'>
     <source network='isolated'/>
     <model type='virtio'/>
   </interface>

6. Shut down, then restart each of these guests.