Hyper-V networkin

[VJ]

Hello,

I'm trying to figure out Hyper-V networking, but coming from the VirtualBox/VMWare makes it a bit more tricky as the approach is different: in Hyper-V, the host network connection goes through the virtual switch, whereas in the others this is not the case.

I just set it up quite standard and ran into the issue the virtual machines in Hyper-V have network (and have internet access), but some routing of UDP packages sent by the host OS goes wrong: they get sent to the virtual switch and are not seen by the rest of the network. The strange thing is that TCP access to/from the host from the rest of the network is not an issue, so I'm not sure how to fix this. I will have to check the details, but I was thinking that just getting a PCIe Ethernet card would facilitate the configuration a great deal, as the host could be connected to the physical network, and could have a dedicated card that participates on the virtual switch.

Would this indeed make things simpler?

A PCIe card is quite cheap and for sure it will help performance wise... The idea is that the hosts contains the files and that several Docker containers (which work in Hyper-V) provide additional protocols to access the data (nextcloud, serviio, music server, ...). The point of this is to keep the host OS clean while still supporting different access methods.



Thanks!

[UtwigMU]

I think if you have multiple VMs getting a network card is a good idea, you may find a 4-port server card for not a lot.

One trick with Hyper-V. I once took a Microsoft course where we worked in pairs. Two students would have 1 Hyper_V hosts each which both ran half of environment and were connected with crossover. Since VM generated MAC addresses were same on both hosts it didn't work since DC wasn't accessible. Took quite some time to troubleshoot that 2 VMs on different hosts had same autogenerated MAC.

[VJ]

It is just a home situation, so the performance of gigabit should suffice; the performance thing is secondary (I also only have two ethernet connections there, so adding more ports to the pc is pointless). There would be multiple VMs, but not that many would be used at the same time. The main reason for adding the second card would be to simplify the network configuration, I really have issues grasping how the vEthernet works on the virtual switch and with a second card I would not have to care about it: card 1 is the access to the physical network, card 2 would bridge to the virtual switch (external) and all should be well. Now, it seems like there is something wrong in the configuration, but only for UDP packages.

Thanks for the heads-up on the mac addresses. I'll keep an eye on them as that could couse issues as well.

[UtwigMU]

https://www.ebay.de/sch/i.html?_from=R40&_sacat=0&_sop=15&_nkw=4+port+gigabit+card&rt=nc&LH_PrefLoc=3

~45 EUR + shipping for 4-port

[VJ]

Yes... but I don't have the wall connections for 4 more network cables. There are only two, with one in use. For around 8-9 euro, I can find a single port card.

I hope that it will solve the issues I have with the UDP packets, as I cannot seem to find a solution online for it. It looks like I'm not the only one struggling with UDP and virtual switches:

https://social.technet.microsoft.com/Forums/windows/en-US/24913e66-3e6e-4bc4-a0e1-d7f1b194a508/hyperv-udp-broadcasts-not-getting-out-on-virtual-switch

https://social.technet.microsoft.com/Forums/windowsserver/en-US/50e5b5e3-0665-41a7-802c-1e9a10a3b0cb/udp-traffic-dropped-hyperv-server-2008-r2

So I'll have to see how to get it to work; but I have a feeling that getting a second card is the easiest as it at least makes it clear which network interface goes where.

[VJ]

Hey, I had a NIC lying around! A PCI 3com 10mbit triple interface (utp, coax and aui) At least it is 100 mbit on the utp...

[VJ]

Just for the fun of it, I decided to plug in the 3C905 pci card. Windows 10 did not recognize it, but apparently has the driver ( https://social.technet.microsoft.com...ows-7-download ) and it works!

At least with this card I can check if there is any point in adding a second network card (if it really makes Hyper-V networking simpler). I plan to reinstall the computer when I figure out how I want it configured, so that would then be the time to get the new nic.

[Umfriend]

I tried Hyper-V once, last winter/christmas. I could not even get a server manager to work on it, LOL. A pity though cause I had plans...

[VJ]

I'm a bit stuck with having to use Hyper-V, as I want to use Docker: Docker runs in Hyper-V. In addition, I want to run a Loxberry; a small home automation thing for Raspberry, which also is provided in Hyper-V images. While it is probably possible to convert this Hyper-V image, it is not possible to run multiple hypervisors with cpu support. So I need to stick with Hyper-V. A shame, as I would love the USB features of e.g. VirtualBox. One of the things I need is a serial port on a virtual client, which with Hyper-V has to go via a named pipe. I found the tools for it, but it is a bit cumbersome. Another thing that would have been nice is a sound card in the virtual client, but also not possible (I know there are ways when connecting a session, but not in a normal server mode).

Still haven't continued with it, as I have so many things to do that I just cannot find the time. Next thing I'll have to do is check whether the available ethernet port has network and if not, which port it is on the patch panel...

[Jammrock]

Standard disclaimer: I work for Microsoft. This is not official support, just helping out in my free time.


Turns out that Hyper-V Networking (HNV) is one of my specialities. I haven't been on MURC in a while so I just saw this.

Windows 10 uses a special switch called the "Default Switch" when you first install it. This is a simple in-box NAT between the host and VM using WinNAT.

Packet -> NIC -> host -> WinNAT -> NAT NIC -> vmSwitch (Hyper-V Virtual Machine Switch) -> VM

This is especially nice when you want to share your host's VPN with VMs (unless you use Cisco AnyConnect which don't play nice). The VPN adapter on the host can share data with VM's through WinNAT.

If you don't need VPN sharing then default switch may not be what you need. Mainly because WinNAT has some known... issues. It's a long story that I can't go into here. UDP sometimes doesn't work if the packet is too big, it's being fixed in 19H2, I think.

The May 21 patch (tentative date) has a bunch of WinNAT fixes that effect Default Switch and Docker NAT networks. Installing this might fix some of the issues.


Side Note: You can't manage Hyper-V through the Server Manager. You have to use the Hyper-V Manager or the new Windows Admin Center, which will be the Server Manager replacement.

https://www.microsoft.com/en-us/cloud-platform/windows-admin-center

https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/use/manage-virtual-machines

Now, if you want your VMs to have a direct network connection, without going through the host network stack and WinNAT, then you want to create an External switch.

Packet -> NIC -> vmSwitch (Hyper-V Virtual Machine Switch) -> VM

https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v/get-started/create-a-virtual-switch-for-hyper-v-virtual-machines

This is a simple L2 switch with very little logic, designed to push tens of Gb of data. There are no known issues with UDP and TCP. This is probably what you want to use.


On to Docker. I know the network side here pretty well too. If you want to run Docker in a VM then you need to enable nested virtualization on that VM. This currently only works on Intel processors with SLAT (Second Level Address Translation), which has been on Intel procs for about a decade now.

https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/user-guide/nested-virtualization

If you're running Docker on the Win10 host, the default NAT network also uses WinNAT... which will be better after the May 21 update (date tentative). My suggestion is to use a Transparent Docker network, which, like the Hyper-V external switch scenario, bypasses the host network stack. It's more efficient and has no known issues, allowing the container direct access to the network through a single software layer (vmSwitch).

https://docs.microsoft.com/en-us/virtualization/windowscontainers/container-networking/network-drivers-topologies

https://docs.microsoft.com/en-us/virtualization/windowscontainers/container-networking/advanced

Native Docker on the host doesn't use Hyper-V, unless you are using a Hyper-V Isolation or a Linux container. The nested virtualization part should be setup automatically in these two cases.

https://docs.microsoft.com/en-us/virtualization/windowscontainers/quick-start/quick-start-windows-10-linux

Hopefully that answers all the questions. Feel free to post any additional questions or problems you are running into and I'll answer as best as I can.

[Umfriend]

Hopefully that answers all the questions. Feel free to post any additional questions or problems you are running into and I'll answer as best as I can.

That would require you to quit your job

[VJ]

Hopefully that answers all the questions. Feel free to post any additional questions or problems you are running into and I'll answer as best as I can.

Thanks for the info!
Yes, I'm using Linux containers in Docker.

My biggest problem was that udp packages from the host not visible on the physical network, and I had no idea how to change this. I haven't yet gotten back to it, but thought it may be easier to use two NICs to avoid this problem (or may make it worse). I had a standard installation of Docker, which adds a switch called DockerNAT (but I don't remember what type of Hyper-V switch it is) and I had a Linux virtual machine connected to the default Hyper-V switch. It was just my first attempt, but I had the impression the UDP packages were sent to the DockerNAT switch. I need to get back to it and start reconfiguring those virtual switches (and the second NIC) to see if that solves the problem. I may have some questions then, but I already know more on how to configure things so I should first try again.

That would require you to quit your job

Is this a stab at me? Or do you have so many questions? Perhaps we can change the M from Matrox (in MURC) to the M from Microsoft?

[Jammrock]

The best advice I can give you is to create an external switch in Hyper-V and a Transparent network in Docker. Then use those for VMs and containers.

That would require you to quit your job

Alas, I don't think MURC can afford my salary...

[VJ]

The best advice I can give you is to create an external switch in Hyper-V and a Transparent network in Docker. Then use those for VMs and containers.

Alas, I don't think MURC can afford my salary...

Interacting on social media is highly rated nowadays for company visibility and popularity... Perhaps if you argue it that way, Microsoft may support it?

On topic: I noticed I don't have a free network port there as I forgot about another networked device. There are two other ports that I may patch, but it would get messy and I may need those later. So I'll have to try and manage with a single network card.

[Umfriend]

Is this a stab at me? Or do you have so many questions? Perhaps we can change the M from Matrox (in MURC) to the M from Microsoft?

Oh, was not intended as a stab at all but that I'd need at least about 80 hours of dedicated time by someone like Jammrock to get a bit up to speed.

Which reminds me. I was chatting IRL with a woman about those language crash courses where you sit in a monastery or somesuch for one or two weeks to learn (or vastly improve) a language. I then got to thinking that it would be great if there was something like that for programming. Not so much to learn to program but to quickly learn a new programming language in a way that builds on what you already know (I have experience with the extinct AS / ASTrac language, VBA and SQL). Most online courses start from scratch but that is not what I am looking for. I don't want it to take ages before I can do with, say, C++ or Java, what I can do with VBA. Anyone know of such a concept?