Libvirt network modes

Libvirt networking usually comes down to four patterns: NAT, bridge, routed, and isolated. The right answer depends on who must reach the guest and how much host networking policy you control.

NAT mode

NAT is the easiest default. Guests can reach outbound networks through the host, while inbound access usually needs explicit port forwarding.

virsh net-list --all
virsh net-dumpxml default

Bridge mode

Bridge mode puts the guest onto a network segment more directly. It is common when guests need first-class presence on the LAN or when another team already owns DHCP and routing.

Bridge failures usually mean the host bridge is missing, unmanaged, or attached to the wrong physical interface.

Routed mode

Routed networks keep a clear boundary while still allowing direct addressability. They are useful when you control upstream routes and want cleaner semantics than NAT.

Isolated mode

Use isolated networks when the guests should only talk to each other or to services intentionally exposed on the host.

Choosing the mode

• Use NAT for fast local labs and simple single-host stacks.
• Use bridge when guests must look like normal peers on the physical network.
• Use routed when you control layer-3 policy and want explicit pathing.
• Use isolated for test cells and blast-radius control.