libvirt users - Oct 2019 - network namespace for multiple overlapping nat networks?

I have noticed that you can't have multiple separate NAT style libvirt
networks defined with the same private IP blocks.

For example I have this default network:

<network>
  <name>default</name>
  <uuid>13baf167-02ff-4312-928c-b82ed4df5785</uuid>
  <forward mode='nat'>
    <nat>
      <port start='1024' end='65535'/>
    </nat>
  </forward>
  <bridge name='virbr1' stp='on' delay='0'/>
  <mac address='52:54:00:9c:8f:7c'/>
  <ip address='192.168.122.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.122.2' end='192.168.122.25'/>
    </dhcp>
  </ip>
</network>

I can't define another nat network that uses the same IP address range.  I
assume this is an implementation limit because of how the iptables rules
are written/work for doing the NAT.


I'd like to have 10 networks with the same default IP address, attached to
10 vms that all run off the same read-only image.  I know that I could use
different ranges and then have my vms use dhcp, and or a few other similar
ways.  I'm limited by the virtual image I want to run (close source OS,
licensed-and-IP-locked software - I have plenty of licences for
instances).

I'd love to replace my 10 instances all with their own IPs on a public
bridge with 10 NAT'd instances all using the same IP each on their own
little network world - so I'd make a separate bridge for each, but of
course it doesn't work.

I have a proof-of-concept setup where I use a routed private network + nat
with the application vm and a small linux vm in pairs.  The linux vms have
a public IP, and a private bridge with a fixed ip to be the default route
of the app vm.  Then the app vm can have a fixed ip, route to a fixed
default route, and get natted to whatever it's buddy router vm's public
IP
is.  This works - but then I have 20 vms instead of 10.  They are small and
dont use much cpu, but they use ram... which is somewhat constraining.  And
I have to maintain a router image.  I'm going to settle for this setup If I
have to, but I'd rather not.

So I had the bright idea of somehow routing/natting each vm through a
network namespace.  I could perhaps avoid having to have a whole separate
linux instance just to get a copy of the network stack to do nat with.  I'm
kind of struggling to see how I'd could have each libvirt vm run in it's
own namespace.  I don't think it is possible actually.  But perhaps I could
use an extra set of IPs and an extra bridge/veth-pair to work some kind of
magic.

Anyone out there doing something like this?  Can you help me wrap my head
around how to mix libvirt kvm VMs and network namespaces?

Is there some other simpler way to achieve what I want?

Thanks.

Fred Clift
fred at clift.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://listman.redhat.com/archives/libvirt-users/attachments/20191003/82d7d239/attachment.htm>