IPv6PrefixDelegation for Virtual Machine Manager

After I set up IPv6 Prefix Delegation (PD) on my Linux router, I realized that I still need an IPv6 subnet for the virtual machines (VMs) I run on my desktop PC.

For a VM to get an address from a delegated prefix, I need a bridged interface with a connected VLAN, and a way to propagate the prefix to that segment. In this guide, I use systemd-networkd. Alternatives like NetworkManager or netplan can be used similarly, but the focus here is on declarative .network and .netdev units.

I also want the VLAN to be configured on my physical switch, with addresses assigned on my router. My host computer works as a bridge in this scenario, not as a NAT gatway or router. This way the VMs do not have acces to my Office VLAN which gives me extra security. This is especially important to me, as one of the VMs is a Windows 11 machine, which I consider insecure.

In the end my network is supposed to look like this:

ATTR_HTML: :width 50%

Next I need a VLAN interface for the virtual machines:

And I need a brigde device to which the VMs can connect.

[NetDev]
Name=br30
Kind=bridge

Now I need to connect the bridge device to the virtual VLAN interface, I called VM. For that I use the following options in /etc/systemd/network/20-vlan3.network.:

• Bridge=br30 connects this VLAN interface to the bridge
• IPv6AcceptRA=yes allows RA to be accepted and relayed to VMs
• LinkLocalAddressing=ipv6 ensures IPv6 link-local addresses are generated

[Match]
Name=VM
Type=vlan

[Network]
Description=VM VLAN interface
Bridge=br30
IPv6AcceptRA=yes
LinkLocalAddressing=ipv6

Connect your VM interfaces to br30 using `virt-manager` or XML:

<interface type='bridge'>
  <source bridge='br30'/>
  <model type='virtio'/>
</interface>

On my raspberry pi router I now need to configure the new VLAN 30 for the VMs. First I need to configure /etc/systemd/network/00-vlan30.netdev there:

[NetDev]
Name=VMs
Kind=vlan

[VLAN]
Id=30

For the whole setup to work I also need to create the VLAN with Id 30 on the managed switch. How to do this depends on your type of switch of course.

You need to make sure, that the interface connect to the host PC is marked as ’tagged’ and that the VLAN 10 and 30 are associated with the port. You also need to associate VLAN 30 with the port to the router.

My system ran on NetworkManager, which I want to replace by systemd-networkd now, which is the better choice on a desktop without Wifi anyway. This is easly done by running:

sudo systemctl disable --now NetworkManager
sydo systemctl enable --now systemd-networkd

Just checking that there occurred no problems:

systemctl status systemd-networkd

The output should look something like this:

● systemd-networkd.service - Network Configuration
     Loaded: loaded (/usr/lib/systemd/system/systemd-networkd.service; enabled; preset: disabled)
     Active: active (running) since Thu 2025-07-31 07:45:37 CEST; 2 days ago
 Invocation: 8fc13f7bd3854763a86c1eb8900269a7
TriggeredBy: ● systemd-networkd.socket
       Docs: man:systemd-networkd.service(8)
             man:org.freedesktop.network1(5)
   Main PID: 1521 (systemd-network)
     Status: "Processing requests..."
      Tasks: 1 (limit: 19023)
   FD Store: 0 (limit: 512)
        CPU: 3.775s
     CGroup: /system.slice/systemd-networkd.service
             └─1521 /usr/lib/systemd/systemd-networkd

Warning: some journal files were not opened due to insufficient permissions.

And I also check that all device are up and configured:

ip --brief a 

Only the Office interface should get an Global Unicast IPv6 Address (GUA).

lo               UNKNOWN        127.0.0.1/8 ::1/128 
enp0s16f0u1      UP             172.16.10.154/24 metric 1024 fe80::dabb:c1ff:fe8b:b9d1/64 
br30             UP             fe80::84d9:45ff:fe20:bb32/64 
Office@enp0s16f0u1 UP             172.16.10.155/24 metric 1024 3fff:abc:def:bf0c:dabb:c1ff:fe8b:b9d1/64 fe80::dabb:c1ff:fe8b:b9d1/64 
VM@enp0s16f0u1   UP             fe80::dabb:c1ff:fe8b:b9d1/64 

Up to this point everything work very straight forward. But when I tried to connect to the network, I didn't get an address. It took me quite some time to find the problem and solve it.

The problem is the default behavior on Linux is, that some packages are filtered on Layer 3 as well as Layer 2. As we are using the host as a mere bridge to the Virtual Machines, that' not desired. So we need to deactivate this behavior for bridge devices:

/etc/sysctl.d/99-brigde.conf

net.bridge.bridge-nf-call-ip6tables=0
net.bridge.bridge-nf-call-iptables=0
net.bridge.bridge-nf-call-arptables=0

This would however only take affect after a system restart, unless you read the file with sysctl:

sudo sysctl -f /etc/sysctl.d/99-bridge.conf

When you know the options to set, it is very easy to set up a dedicated VLAN from you router straight to you VMs. There are of course two more things to consider:

• You can not easily bridge Wifi interfaces.
• Your VMs are on a separate subnet, so you can not just ssh into them. There are serveral possible solutions to this:
  • Dedicated forwarding roules using nftables.
  • Use tailscale or nebula.
  • My preferred method is however a proxy jump over my pi-router. In ${HOME}/.ssh/config it looks like that:

Host Win Windows Window11 Windoof win
     HostName          fe80::d8b8:3a7:126b:162b%%VMs
     User             Username
     IdentityFile       ~/.ssh/win
     ProxyJump         pi
Host *
    IdentitiesOnly      yes

Host Win Windows Window11 Windoof win

Defines a group of host aliases. You can use any of these names (`Win`, `Windows`, etc.) with `ssh`, and the settings below will apply.

HostName fe80::d8b8:3a7:126b:162b%%VMs

Specifies the actual destination host. In this case, it's a link-local IPv6 address with the zone index `%%VMs` (the interface name needed for link-local communication).

User Username

Sets the SSH username to `Username` for this host.

IdentityFile ~/.ssh/win

Specifies the private SSH key file to use when connecting to this host.

ProxyJump pi

Uses the host alias `pi` as a jump host (SSH proxy). SSH will first connect to `pi`, then use it to reach the Windows machine.

Host *

A wildcard match for all hosts not explicitly listed above.

IdentitiesOnly yes

Ensures that only the identity files explicitly specified in the config (e.g. `~/.ssh/win`) are used for authentication, preventing SSH from trying other keys loaded in the agent.