Hi, thanks for your answer.
I need "real world" connectivity. My current (debian) setup is as follows: /etc/network/interfaces: auto natbr0 iface natbr0 inet static address 10.0.2.2 netmask 255.255.255.0 metric 1 bridge_ports dummy0 bridge_stp off bridge_fd 0 bridge_maxwait 0 pre-up modprobe ip_conntrack_tftp pre-up modprobe ip_conntrack_ftp pre-up modprobe ip_nat_tftp pre-up modprobe ip_nat_ftp up echo "`route -n | sed -n 's/^0\.0\.0\.0 .* \(.*\)$/\1/p'`" > /var/run/${IFACE}_route up /usr/sbin/dnsmasq --interface=${IFACE} --except-interface=lo --bind-interfaces --user=nobody \ --dhcp-range=natbr0,10.0.2.15,10.0.2.15,255.255.255.0,10.0.2.255,72h \ --domain=localnet --pid-file=/var/run/${IFACE}_dnsmasq.pid --conf-file up echo 1 > /proc/sys/net/ipv4/ip_forward up iptables -A FORWARD -s 10.0.2.0/24 -j ACCEPT up iptables -A FORWARD -d 10.0.2.0/24 -j ACCEPT post-up iptables -t nat -A POSTROUTING -o natbr0 -j MASQUERADE post-up echo 600 > /proc/sys/net/ipv4/tcp_keepalive_time post-up echo 50 > /proc/sys/net/ipv4/tcp_keepalive_probes post-up echo 10 > /proc/sys/net/ipv4/tcp_keepalive_intvl down iptables -D FORWARD -s 10.0.2.0/24 -j ACCEPT down iptables -D FORWARD -d 10.0.2.0/24 -j ACCEPT down iptables -t nat -D POSTROUTING -o natbr0 -j MASQUERADE post-down kill -s TERM `cat /var/run/${IFACE}_dnsmasq.pid` && rm -f /var/run/${IFACE}_dnsmasq.pid post-down rm -f /var/run/${IFACE}_route where my "server boxes" are connected as: /etc/qemu-kvm/qemu-ifup-br: #!/bin/sh BRIDGE=br0 /sbin/ifconfig $1 0.0.0.0 up /usr/sbin/brctl addif $BRIDGE $1 if they need full connectivity, or as: /etc/qemu-kvm/qemu-ifup-natbr: #!/bin/sh BRIDGE=natbr0 /sbin/ifconfig $1 0.0.0.0 up /usr/sbin/brctl addif $BRIDGE $1 /sbin/iptables -t nat -A POSTROUTING -o "`route -n | sed -n 's/^0\.0\.0\.0 .* \(.*\)$/\1/p'`" -j MASQUERADE || : "hidden" behind NAT. Only my "client boxes" (multiple virtual client boxes on the same server - currently setup using usermode networking) need identical MACs. They don't need to "talk" to one another, but they do need to be able to talk to the servers and the "outside world". I'm hoping that maybe someone that's a little more "network savvy" can give me a tip in the right direction. vlans, ebtables, iptables, ppp, funky NAT setups, etc... Thanks, and best regards, Robert > Cc: qemu-devel@nongnu.org > Sent: Saturday, August 7, 2010 7:23:29 AM > Subject: Re: [Qemu-devel] guest MAC-address isolation > > Hi... > > On Fri, Aug 6, 2010 at 22:10, Robert Rebstock <rebst...@scienceworks.com> > wrote: > > Hello all, > > > > can anyone recommend a better way to achive (guest agnostic) MAC-address > > isolation in qemu/kvm than with user-mode networking? > > > > I have multiple guests requiring the same MAC-address, and user-mode/slirp > > networking is quite slow. > > Never tried thing like this, but IMHO as long as your guest isn't > meant to be connected to "real world" ...meaning something like > brigdged to your real eth0, i think duplicate MAC is doable. > > Oh ..and...maybe make sure your guests are on different VLANs....IIRC, > they are all hooked to VLAN 0 by default. > > >-- > regards, > > Mulyadi Santosa > Freelance Linux trainer and consultant > > blog: the-hydra.blogspot.com > training: mulyaditraining.blogspot.com