I would like to install windows 10 ltsc iot inside qemu/kvm using virt-manager. My question is will this be completely isolated from the host os (linux mint 22.3 cinnamon)?
I am used to running virtual machines on windows 10 using virtualbox. I just wanted to confirm that this setup should be good before going ahead. I intend to run only open source software on the linux install and this is a closed source / hostile / untrustworthy OS. I wanted to make sure it is fully isolated like I am used to with virtualbox.
Thank you.
You must log in or # to comment.
Not sure what sort of isolation you’re expecting but yes, QEMU + virt-manager will be a very similar experience to using virtualbox. Both offer the same sort of isolation so I don’t think you’d run into any surprises.
In both managers the VM does usually have internet access by default via NAT switch on the host system but you could re-configure it to bridge networking if you wanted. You could probably get rid of the NIC entirely if you don’t want it to have network access (haven’t personally needed to do that but it should be doable).
You do need to do some extra configuration if you need to share files between the Linux host and the Windows VM but I suspect you don’t want to do that if you’re looking for isolation.
Thank you. What is the difference between NAT and bridge in simple terms?
Not sure how you had it set up in VirtualBox but I’m guessing you should just do the same thing since that’s what you’re used to.
The other comment is correct but if you need a slightly shorter version
Bridge networking = Pretend the VM is its own separate physical computer plugged into your network. It is receiving an IP address from your network router, it is doing DNS through the network router, etc. And the network router is able to direct incoming internet traffic directly to the VM if configured that way so you could do stuff like port forwarding to a specific open port in the VM if you choose.
NAT = The host system (your Linux computer) is pretending to be a virtual router for the VM, the VM is not doing any direct communication with the network router. The VM gets its IP address from the host computer (the virtual NAT router). Since the VM sits behind the host computer that means it’s double-NAT’d, all internet traffic goes through the host first. It is not possible to configure an incoming port forward from the internet router directly to the VM.
Excellent explanation, thank you very much. Since I am using a VPN configuration on the host computer, am I correct in thinking NAT is the option I want if I want all traffic routed through that? It seems to function that way at the moment (checking IP on speedtest). If I recall, I had it configured that way on virtualbox. I want everything to network wise to be piped through the host first so if in the future I have custom firewall rules etc on the host, those are in place from the sounds of it using NAT correct?
Thanks again.
Ooh, ooh! I know this one!
NAT stands for “Network Address Translation.” The important idea is that when your guest machine (windows) tries to access the internet, it sends the traffic to your hypervisor (VirtualBox or qemu/kvm). Your hypervisor then passes it to your host OS, which changes the source IP address to its own, and changes the source port to one that will help it recognize traffic meant for the windows virtual machine. It then passes that traffic on to your router, which does a similar thing so that the broader internet can’t just access any device on your home network willy-nilly. When the server your windows machine contacted responds, it addresses the traffic to your host machine’s IP with the special port that lets your host know it’s meant for the virtual machine.
To simplify this into an analogy with the postal service: 5 year old Billy (your windows VM) wants to write a letter to Ted (a server or device somewhere outside of your host machine). Billy writes his letter and addresses it to Ted, but in the return address field, he writes “Billy’s Room.” He then hands the letter to his mom (the host machine) to mail it for him; knowing that Ted probably doesn’t know where the flying fuck “Billy’s room” is, she quickly crosses it out and writes her home address. She then mails it. When Ted gets the letter, he responds and addresses it to Billy @ Billy’s mom’s house. She gets the letter, sees that it’s addressed to Billy, and takes it to his room.
A bridge is a virtual interface that allows the virtual machine to send traffic directly to the hardware (networking card) without bothering the host machine. This allows it to get its own IP address on the local network, and for everything on that network it appears to be a separate machine from your host.
This is like if Ted and Billy get to writing letters all the time, and Billy’s dad (you) realizes he can just set up a second mailbox outside the house for Billy and negotiate with the postal service so that the address on the mailbox is “Billy’s room.” Now Billy’s mom never has to handle his mail or rewrite the addresses anymore, which is good, because Ted just mailed Billy a bomb (because no one, not even Billy, can know where Ted Kaczynski is).