Puffy image/svg+xml Puffy 2019-06-14 Stéphane HUC OpenBSD Team Inkscape Puffy OpenBSD https://www.openbsd.org/art4.html English "Puffy", it's a symbol of OpenBSD

[OpenBSD :: Virtualization] Host and guests on the same network

Article published the ; modified the
5 minutes to read

This article has 903 words.
RAW source of the article:
Commit version: f445092


To virtualize on OpenBSD, since 5.9, is easy; you need to pay attention to certains details.

This article is about to virtualize host and guests on same network.

  • Version : native
  • OS : OpenBSD 6.46.9


First, check if the machine is CPU compliant:

$ dmesg | egrep '(VMX/EPT|SVM/RVI)'

The result should be:

⇒ for Intel CPU:

vmm0 at mainbus0: VMX/EPT

⇒ for AMD CPU:

vmm0 at mainbus0: SVM/RVI

If the system returns no result, then the virtualization is not possible, never. Just in case, check on your BIOS|UEFI, and see if the option is disabled.



After downloading the ultime instalXX.iso, and checking it…

Why using, preferably, the iso image? To install OpenBSD by option cd, because the install sets are on.

For instance, with the 6.9 release:

$ ftp https://cdn.openbsd.org/pub/OpenBSD/6.9/amd64/{install69.iso,SHA256,SHA256.sig}
$ sha256 -C SHA256 install69.iso
(SHA256) install69.iso: OK
$ signify -Cp /etc/signify/openbsd-69-base.pub -x SHA256.sig install69.iso
Signature Verified
install69.iso: OK

⇒ Create the VM:

$ vmctl create -s 50G disk.qcow2

⇒ Start the install:

# vmctl start -c -m 1G -i 1 -r installXX.iso -d disk.qcow2 test

Do the install, and after a few minutes, at the end, choose [halt] to shutdown correctly the OS into the VM. To leave the serial console, use the escape sequence : ~.; or if you are on SSH session: ~~..



Assuming that:

  • the network segment is on Class C, as
  • address IP of gateway:
  • DNS resolvers: perhaps those about FDN…

These informations are the network parameters to configure the VM.

The following parameters are made on:


Only the Ethernet devices, not Wireless, can be used.

Prefer to use static adress IP, because dhcp can complicate matters.


In this article, we assume that your network interface is managed by the em(4) Intel firmware.

Change segun your case, if necessary.

Configue the /etc/hostname.em0 file:



/etc/vm.conf is the file configuration:

switch "sw" {
    interface bridge0

vm "test" {    
    disk /home/your_user/disk.qcow2 format qcow2
    memory 1G
    interface { switch "sw" }
    owner your_user


Configure the bridge to manage em0:

# echo 'add em0' > /etc/hostname.bridge0
# sh /etc/netstart bridge0


Which is not mentioned in the FAQ, has a lot to do with PF, mainly.

Another important information: when the VM is running, on tap interface is created and mounted by the bridge.



According to the notes of the bridge manpage, set the rules on PF to manage the bridge is possible, but you need to be very fine-tuned and have an excellent understanding about the network flow within PF.

Do simple:

⇒ pass all on the interface group tap:

pass on tap

Now, you need to manage the physical network interface; here: em0

⇒ create a table to manage all the VMs:

table <vm_tap> const { }

and, for the exemple, authozise SSH to VMs:

pass in log on em0 inet proto tcp from any to <vm_tab> port 22 

Of course, these PF rules are minimalist. It’s up to you!

Finally, remember to manage PF rules within the VM.

tap - Ethernet tunnel pseudo-device

OpenBSD create 4 tap interfaces, by default. If you need more VM, you need to create more tap interfaces.

See the note

And use MAKEDEV(8), as:

# sh MAKEDEV tap5

Egual, it’s possible to assign such pseudo virtual device tap to such VM. Use the keyword interface:

vm "test" { 
    interface tap5 { … }

Another information to understand: as long as the VM is not active, the matching tap interface will not be created and mounted on the bridge. Compare with ifconfig command, before and after. ;-)


NO, it’s not necessary to configure systcl to forward the trafic. We do not make NAT!

See the manpage vmctl:

If NAT is desired, the net.inet.ip.forwarding sysctl(8) must also be set to 1.

So, in the bridge context where host and guests are on same network, no need to forward the flow.


  • Here an example of a patched L1TF Intel CPU where the boot media was not found, with error message in dmesg: vmx_fault_page: uvm_fault returns 14, GPA=0xffffca78, rip=0xfbd49

Enjoy-IT! Enjoy-ID!