Azure nested KVM virtualization network bridge issue

Yeah, what you’re running into is a pretty common limitation when trying to use bri insAzure (the u

Here’s what’s happening:

• Your Azure VM is essentially a guest running under Hyper-V on the Azure host.

When you create a “bridge” inside your Azure VM, that bridge is not a true Layer 2 bridge connected to the Azure VNet.

Azure VNets only support Layer 3 connectivity (routing between VMs is done at the Azure fabric level).

That’s why your nested KVM VM can talk to the host (they’re connected locally inside the same Azure VM), but not to other Azure VMs — the packets never make it to the Azure virtual switch.

Options to fix or work around it:

Use NAT or Macvtap (preferred workaround):

Configure your KVM guests with NAT networking or use macvtap in bridge mode with “passthrough” if supported.

  This way, your guest traffic will be routed through the host’s IP, which Azure allows.
  
  **Set up a routed network (instead of bridged):**
  
     Assign a private subnet to your nested VMs (e.g. 10.0.2.0/24).
     
        Enable IP forwarding on the Azure VM and configure routes in Azure (User Defined Routes) so other Azure VMs know to reach that subnet via the host’s IP.
        
        **Use Azure SDN features:**
        
           If this PoC could be extended, you might consider running a virtual network appliance (like VyOS or pfSense) as your Azure VM and then nest KVM behind it. That gives you more control over routing.
           

In short — you won’t get true L2 bridging on Azure. You’ll need to switch to a routed or NAT approach.Yeah, what you’re running into is a pretty common limitation when trying to use bri insAzure (the u

Here’s what’s happening:

Your Azure VM is essentially a guest running under Hyper-V on the Azure host.

When you create a “bridge” inside your Azure VM, that bridge is not a true Layer 2 bridge connected to the Azure VNet.

Azure VNets only support Layer 3 connectivity (routing between VMs is done at the Azure fabric level).

That’s why your nested KVM VM can talk to the host (they’re connected locally inside the same Azure VM), but not to other Azure VMs — the packets never make it to the Azure virtual switch.

Options to fix or work around it:

Use NAT or Macvtap (preferred workaround):

Configure your KVM guests with NAT networking or use macvtap in bridge mode with “passthrough” if supported.

  This way, your guest traffic will be routed through the host’s IP, which Azure allows.
  
  **Set up a routed network (instead of bridged):**
  
     Assign a private subnet to your nested VMs (e.g. 10.0.2.0/24).
     
        Enable IP forwarding on the Azure VM and configure routes in Azure (User Defined Routes) so other Azure VMs know to reach that subnet via the host’s IP.
        
        **Use Azure SDN features:**
        
           If this PoC could be extended, you might consider running a virtual network appliance (like VyOS or pfSense) as your Azure VM and then nest KVM behind it. That gives you more control over routing.
           

In short — you won’t get true L2 bridging on Azure. You’ll need to switch to a routed or NAT approach.