I would like to install windows 10 ltsc iot inside qemu/kvm using virt-manager. My question is will this be completely isolated from the host os (linux mint 22.3 cinnamon)?
I am used to running virtual machines on windows 10 using virtualbox. I just wanted to confirm that this setup should be good before going ahead. I intend to run only open source software on the linux install and this is a closed source / hostile / untrustworthy OS. I wanted to make sure it is fully isolated like I am used to with virtualbox.
Thank you.
Ooh, ooh! I know this one!
NAT stands for “Network Address Translation.” The important idea is that when your guest machine (windows) tries to access the internet, it sends the traffic to your hypervisor (VirtualBox or qemu/kvm). Your hypervisor then passes it to your host OS, which changes the source IP address to its own, and changes the source port to one that will help it recognize traffic meant for the windows virtual machine. It then passes that traffic on to your router, which does a similar thing so that the broader internet can’t just access any device on your home network willy-nilly. When the server your windows machine contacted responds, it addresses the traffic to your host machine’s IP with the special port that lets your host know it’s meant for the virtual machine.
To simplify this into an analogy with the postal service: 5 year old Billy (your windows VM) wants to write a letter to Ted (a server or device somewhere outside of your host machine). Billy writes his letter and addresses it to Ted, but in the return address field, he writes “Billy’s Room.” He then hands the letter to his mom (the host machine) to mail it for him; knowing that Ted probably doesn’t know where the flying fuck “Billy’s room” is, she quickly crosses it out and writes her home address. She then mails it. When Ted gets the letter, he responds and addresses it to Billy @ Billy’s mom’s house. She gets the letter, sees that it’s addressed to Billy, and takes it to his room.
A bridge is a virtual interface that allows the virtual machine to send traffic directly to the hardware (networking card) without bothering the host machine. This allows it to get its own IP address on the local network, and for everything on that network it appears to be a separate machine from your host.
This is like if Ted and Billy get to writing letters all the time, and Billy’s dad (you) realizes he can just set up a second mailbox outside the house for Billy and negotiate with the postal service so that the address on the mailbox is “Billy’s room.” Now Billy’s mom never has to handle his mail or rewrite the addresses anymore, which is good, because Ted just mailed Billy a bomb (because no one, not even Billy, can know where Ted Kaczynski is).