|
1 | | -# Network |
2 | | - |
3 | | -## user-mode network (192.168.5.0/24) |
4 | | - |
5 | | -By default Lima only enables the user-mode networking aka "slirp". |
6 | | - |
7 | | -### Guest IP (192.168.5.15) |
8 | | - |
9 | | -The guest IP address is set to `192.168.5.15`. |
10 | | - |
11 | | -This IP address is not accessible from the host by design. |
12 | | - |
13 | | -Use VMNet (see below) to allow accessing the guest IP from the host and other guests. |
14 | | - |
15 | | -### Host IP (192.168.5.2) |
16 | | - |
17 | | -The loopback addresses of the host is `192.168.5.2` and is accessible from the guest as `host.lima.internal`. |
18 | | - |
19 | | -### DNS (192.168.5.3) |
20 | | - |
21 | | -The DNS. |
22 | | - |
23 | | -If `useHostResolver` in `lima.yaml` is true, then the hostagent is going to run a DNS server over tcp and udp - each on a separate randomly selected free port. This server does a local lookup using the native host resolver, so it will deal correctly with VPN configurations and split-DNS setups, as well as mDNS, local `/etc/hosts` etc. For this the hostagent has to be compiled with `CGO_ENABLED=1` as default Go resolver is [broken](https://github.com/golang/go/issues/12524). |
24 | | - |
25 | | -These tcp and udp ports are then forwarded via iptables rules to `192.168.5.3:53`, overriding the DNS provided by QEMU via slirp. |
26 | | - |
27 | | -Currently following request types are supported: |
28 | | - |
29 | | -- A |
30 | | -- AAAA |
31 | | -- CNAME |
32 | | -- TXT |
33 | | -- NS |
34 | | -- MX |
35 | | -- SRV |
36 | | - |
37 | | -For all other queries hostagent will redirect the query to the nameservers specified in `/etc/resolv.conf` (or, if that fails - to `8.8.8.8` and `1.1.1.1`). |
38 | | - |
39 | | -DNS over tcp is rarely used. It is usually only used either when user explicitly requires it, or when request+response can't fit into a single UDP packet (most likely in case of DNSSEC), or in the case of certain management operations such as domain transfers. Neither DNSSEC nor management operations are currently supported by a hostagent, but on the off chance that the response may contain an unusually long list of records - hostagent will also listen for the tcp traffic. |
40 | | - |
41 | | -During initial cloud-init bootstrap, `iptables` may not yet be installed. In that case the repo server is determined using the slirp DNS. After `iptables` has been installed, the forwarding rule is applied, switching over to the hostagent DNS. |
42 | | - |
43 | | -If `useHostResolver` is false, then DNS servers can be configured manually in `lima.yaml` via the `dns` setting. If that list is empty, then Lima will either use the slirp DNS (on Linux), or the nameservers from the first host interface in service order that has an assigned IPv4 address (on macOS). |
44 | | - |
45 | | -## VMNet networks |
46 | | - |
47 | | -VMNet assigns a "real" IP address that is reachable from the host. |
48 | | - |
49 | | -The configuration steps are different for each network type: |
50 | | -- [socket_vmnet](#socket_vmnet) |
51 | | -- [vzNAT](#vzNAT) |
52 | | - |
53 | | -### socket_vmnet |
54 | | -#### Managed (192.168.105.0/24) |
55 | | - |
56 | | -[`socket_vmnet`](https://github.com/lima-vm/socket_vmnet) is required for adding another guest IP that is accessible from the host and other guests. |
57 | | - |
58 | | -```bash |
59 | | -# Install socket_vmnet |
60 | | -brew install socket_vmnet |
61 | | - |
62 | | -# Set up the sudoers file for launching socket_vmnet from Lima |
63 | | -limactl sudoers >etc_sudoers.d_lima |
64 | | -sudo install -o root etc_sudoers.d_lima /etc/sudoers.d/lima |
65 | | -``` |
66 | | - |
67 | | -> **Note** |
68 | | -> |
69 | | -> Lima before v0.12 used `vde_vmnet` for managing the networks. |
70 | | -> `vde_vmnet` is still supported but it is deprecated and no longer documented here. |
71 | | -
|
72 | | -The networks are defined in `$LIMA_HOME/_config/networks.yaml`. If this file doesn't already exist, it will be created with these default |
73 | | -settings: |
74 | | - |
75 | | -<details> |
76 | | -<summary>Default</summary> |
77 | | - |
78 | | -<p> |
79 | | - |
80 | | -```yaml |
81 | | -# Path to socket_vmnet executable. Because socket_vmnet is invoked via sudo it should be |
82 | | -# installed where only root can modify/replace it. This means also none of the |
83 | | -# parent directories should be writable by the user. |
84 | | -# |
85 | | -# The varRun directory also must not be writable by the user because it will |
86 | | -# include the socket_vmnet pid file. Those will be terminated via sudo, so replacing |
87 | | -# the pid file would allow killing of arbitrary privileged processes. varRun |
88 | | -# however MUST be writable by the daemon user. |
89 | | -# |
90 | | -# None of the paths segments may be symlinks, why it has to be /private/var |
91 | | -# instead of /var etc. |
92 | | -paths: |
93 | | -# socketVMNet requires Lima >= 0.12 . |
94 | | -# socketVMNet has precedence over vdeVMNet. |
95 | | - socketVMNet: /opt/socket_vmnet/bin/socket_vmnet |
96 | | -# vdeSwitch and vdeVMNet are DEPRECATED. |
97 | | - vdeSwitch: /opt/vde/bin/vde_switch |
98 | | - vdeVMNet: /opt/vde/bin/vde_vmnet |
99 | | - varRun: /private/var/run/lima |
100 | | - sudoers: /private/etc/sudoers.d/lima |
101 | | - |
102 | | -group: everyone |
103 | | - |
104 | | -networks: |
105 | | - shared: |
106 | | - mode: shared |
107 | | - gateway: 192.168.105.1 |
108 | | - dhcpEnd: 192.168.105.254 |
109 | | - netmask: 255.255.255.0 |
110 | | - bridged: |
111 | | - mode: bridged |
112 | | - interface: en0 |
113 | | - # bridged mode doesn't have a gateway; dhcp is managed by outside network |
114 | | - host: |
115 | | - mode: host |
116 | | - gateway: 192.168.106.1 |
117 | | - dhcpEnd: 192.168.106.254 |
118 | | - netmask: 255.255.255.0 |
119 | | -``` |
120 | | -
|
121 | | -</p> |
122 | | -
|
123 | | -</details> |
124 | | -
|
125 | | -Instances can then reference these networks from their `lima.yaml` file: |
126 | | - |
127 | | -```yaml |
128 | | -networks: |
129 | | - # Lima can manage the socket_vmnet daemon for networks defined in $LIMA_HOME/_config/networks.yaml automatically. |
130 | | - # The socket_vmnet binary must be installed into a secure location only alterable by the admin. |
131 | | - # The same applies to vde_switch and vde_vmnet for the deprecated VDE mode. |
132 | | - # - lima: shared |
133 | | - # # MAC address of the instance; lima will pick one based on the instance name, |
134 | | - # # so DHCP assigned ip addresses should remain constant over instance restarts. |
135 | | - # macAddress: "" |
136 | | - # # Interface name, defaults to "lima0", "lima1", etc. |
137 | | - # interface: "" |
138 | | -``` |
139 | | - |
140 | | -The network daemon is started automatically when the first instance referencing them is started, |
141 | | -and will stop automatically once the last instance has stopped. Daemon logs will be stored in the |
142 | | -`$LIMA_HOME/_networks` directory. |
143 | | - |
144 | | -The IP address is automatically assigned by macOS's bootpd. |
145 | | -If the IP address is not assigned, try the following commands: |
146 | | -```bash |
147 | | -/usr/libexec/ApplicationFirewall/socketfilterfw --add /usr/libexec/bootpd |
148 | | -/usr/libexec/ApplicationFirewall/socketfilterfw --unblock /usr/libexec/bootpd |
149 | | -``` |
150 | | - |
151 | | -#### Unmanaged |
152 | | -For Lima >= 0.12: |
153 | | -```yaml |
154 | | -networks: |
155 | | - # Lima can also connect to "unmanaged" networks addressed by "socket". This |
156 | | - # means that the daemons will not be controlled by Lima, but must be started |
157 | | - # before the instance. The interface type (host, shared, or bridged) is |
158 | | - # configured in socket_vmnet and not in lima. |
159 | | - # - socket: "/var/run/socket_vmnet" |
160 | | -``` |
161 | | - |
162 | | -<details> |
163 | | -<summary>For older Lima releases</summary> |
164 | | - |
165 | | -<p> |
166 | | - |
167 | | -```yaml |
168 | | -networks: |
169 | | - # vnl (virtual network locator) points to the vde_switch socket directory, |
170 | | - # optionally with vde:// prefix |
171 | | - # ⚠️ vnl is deprecated, use socket. |
172 | | - # - vnl: "vde:///var/run/vde.ctl" |
173 | | - # # VDE Switch port number (not TCP/UDP port number). Set to 65535 for PTP mode. |
174 | | - # # Builtin default: 0 |
175 | | - # switchPort: 0 |
176 | | - # # MAC address of the instance; lima will pick one based on the instance name, |
177 | | - # # so DHCP assigned ip addresses should remain constant over instance restarts. |
178 | | - # macAddress: "" |
179 | | - # # Interface name, defaults to "lima0", "lima1", etc. |
180 | | - # interface: "" |
181 | | -``` |
182 | | -</p> |
183 | | - |
184 | | -</details> |
185 | | - |
186 | | -### vzNAT |
187 | | - |
188 | | -> **Warning** |
189 | | -> "vz" mode is experimental |
190 | | - |
191 | | -| :zap: Requirement | Lima >= 0.14, macOS >= 13.0 | |
192 | | -|-------------------|-----------------------------| |
193 | | - |
194 | | -For [VZ](./vmtype.md) instances, the "vzNAT" network can be configured as follows: |
195 | | -```yaml |
196 | | -networks: |
197 | | -- vzNAT: true |
198 | | -``` |
199 | | - |
200 | | -The range of the IP address is not specifiable. |
201 | | - |
202 | | -The "vzNAT" network does not need the `socket_vmnet` binary and the `sudoers` file. |
203 | | - |
204 | | -## Lima user-v2 network |
205 | | - |
206 | | -| :zap: Requirement | Lima >= 0.16.0 | |
207 | | -|-------------------|----------------| |
208 | | - |
209 | | -user-v2 network provides a user-mode networking similar to the [default user-mode network](#user-mode-network--1921685024-) and also provides support for `vm -> vm` communication. |
210 | | - |
211 | | -> **Warning** |
212 | | -> This network mode is experimental |
213 | | - |
214 | | -To enable this network mode, define a network with `mode: user-v2` in networks.yaml |
215 | | - |
216 | | -```yaml |
217 | | -... |
218 | | -networks: |
219 | | - example-user-v2: |
220 | | - mode: user-v2 |
221 | | -... |
222 | | -``` |
223 | | - |
224 | | -Instances can then reference these networks from their `lima.yaml` file: |
225 | | - |
226 | | -```yaml |
227 | | -networks: |
228 | | - - lima: example-user-v2 |
229 | | -``` |
230 | | - |
231 | | -_Note_ |
232 | | - |
233 | | -- Enabling this network will disable the [default user-mode network](#user-mode-network--1921685024-) |
234 | | -- Subnet used for this network is 192.168.5.0/24 with 192.168.5.2 used for host connection and 192.168.5.3 used for DNS resolution |
235 | | - |
| 1 | +Moved to <https://lima-vm.io/docs/config/network/> |
0 commit comments