Virtual switches: how VMs and containers actually reach the network

Virtual switches are software components that mimic the behavior of physical switches, allowing virtual machines (VMs) and containers to communicate with each other and with external networks. They manage tasks such as MAC address learning, frame forwarding, and VLAN tagging. Once you grasp this concept, understanding virtualization networking becomes straightforward.

Overview

A hypervisor host acts like a building full of VMs that need network access through the building's physical uplinks. A virtual switch is software performing exactly what a physical switch does—connecting virtual NICs (vNICs) to real ones and managing traffic accordingly.

Implementations

Linux Bridge

• Standard, in-kernel virtual switch: Proxmox’s default vmbr0 is an example of this. Physical NICs are enslaved to the bridge, VMs attach vNICs to it, and they appear directly on the LAN like real machines.
• Pros: Simple, fast, suitable for most labs.

Open Virtual Switch (OVS)

• Enterprise-grade software switch: Adds VLAN trunking at scale, flow programming (OpenFlow/SDN), and bonding features. Proxmox supports it as an alternative to bridges; open-source platforms like OpenStack/NSX use OVS.
• Pros: More advanced features for larger environments.

VMware vSwitch / Hyper-V Virtual Switch

• Vendor-specific implementations of the same concept:
  • VMware Distributed vSwitch: A single logical switch spanning multiple hosts, simplifying configuration and deployment across a cluster.
  • Hyper-V Virtual Switch: Similar functionality but tailored to Microsoft’s ecosystem.
• Pros: Vendor-specific features and optimizations.

Container Networking

• Docker Bridge Network (docker0): Another Linux bridge with NAT to the host. VM networking and container networking follow similar principles at different levels of abstraction.

Networking Patterns

1. Bridged

   • VM sits on the LAN as a peer: Gets DHCP from your router.
   • Default for homelab services.

2. NAT (Network Address Translation)

   • VMS hide behind the host: Similar to how home internet hides devices behind a router.
   • Default for desktop virtualbox, isolation labs.

3. Host-Only/Isolated

   • Virtual switch with no physical uplink: Vms talk only to each other.
   • Perfect for malware labs, cluster experiments, "what does this do" testing.

4. VLAN-Aware Bridging

   • Tag VLANs on the virtual switch: Different VMs land in different segments over one physical NIC + a trunk port on the real switch.
   • The moment homelab virtual and physical networking marry.

Debugging Network Issues

When a VM has no network, troubleshooting follows similar steps to debugging physical networks:

1. Ensure the vNIC is attached to the correct bridge (cable in the right switch?).
2. Check if the bridge is up.
3. Verify VLAN tags match.
4. Use tcpdump on the bridge for detailed frame analysis.

By understanding these concepts and patterns, you can effectively manage virtual networking in your homelab or enterprise environment.