TC-VLAN-001 proved that br-net1 and br-net2 are fully isolated from each other. This test shows how a router VM acts as a gateway between two isolated networks — exactly like inter-VLAN routing in physical networks. The router VM has an interface in both bridges and forwards packets between the subnets. Safe on Hetzner: everything runs over internal software bridges without a physical port.
Prerequisites checklist
Confirm these before running steps:
1Step 1 — Create router VM (interfaces in BOTH networks: net1-bridge + net2-bridge + masquerade for SSH)
2Step 2 — Start client VM-A in net1-bridge (192.168.10.20)
3Step 3 — Start client VM-C in net2-bridge (192.168.20.20)
4Step 4 — In router VM: verify the IP configuration:
virtctl ssh fedora@vm/vm-router -n vmtest -i ~/.ssh/ocp-vm-key --command "ip addr"→ enp2s0: 192.168.10.1/24
→ enp3s0: 192.168.20.1/24
→ If it does not set the IPs automatically, you can set them manually:
→ sudo ip addr add 192.168.10.1/24 dev enp2s0 && sudo ip link set enp2s0 up
→ sudo ip addr add 192.168.20.1/24 dev enp3s0 && sudo ip link set enp3s0 up
5Step 5 — Verify IP forwarding in router VM:
virtctl ssh fedora@vm/vm-router -n vmtest -i ~/.ssh/ocp-vm-key --command "sudo sysctl -n net.ipv4.ip_forward"→ must return 1
6Step 6 — TEST: In VM-A: ping 192.168.20.20 → must succeed (via router VM)
7Step 7 — Verify: tcpdump on router VM shows packets on BOTH interfaces
8Step 8 — Cleanup: delete all VMs