Networking

Each VM gets one network connection, and you choose where it plugs in: a private network inside the host, or your own network.

Choice	Who can reach the VM	What it needs
NAT	The host and the other VMs. The VM can reach the internet.	Nothing. It's the default, and the only choice on a Mac.
Your network (bridge)	Anything on your network, as with a physical computer	Linux, a wired connection, and a bridge on the host
VLAN tag	Whatever your router allows on that VLAN	A bridge-capable host, and a router or switch set up for VLANs

NAT

The VM gets a private address behind the host, the way a laptop does behind a home router: 192.168.122.0/24 on Linux, 192.168.64.0/24 on a Mac. It can reach the internet and every other NAT VM on the host.

Other machines on your network can't open a connection to it. There are two ways in:

Each service, such as a database or a Kubernetes API, gets a port on the host that other machines can use once you share the service.
SSH through the host, from your laptop: ssh -J you@host admin@192.168.122.14.

NAT VMs aren't isolated from each other. If you need that, use VLANs.

Your network (bridge)

The VM joins your network as if it were plugged into your switch. Your router gives it an address, which shows on its card, and anything on the network can reach it.

The host needs a bridge: a virtual switch with one of its wired ports plugged in. Wi-Fi can't be bridged. Nano Cloud won't create the bridge, because moving the host's own address onto it can cut you off from a remote machine. Set it up once with your distribution's tools and Nano Cloud offers every bridge that has a wired port.

On Ubuntu with netplan, replacing enp3s0 with your wired port:

network:
  version: 2
  ethernets:
    enp3s0:
      dhcp4: false
  bridges:
    br0:
      interfaces: [enp3s0]
      dhcp4: true

Save it as /etc/netplan/60-bridge.yaml and apply it with sudo netplan try, which rolls back unless you confirm within two minutes. The host's address moves to br0 and may change, so do this at the machine, or be ready to find it again.

With NetworkManager, on Fedora and others:

sudo nmcli connection add type bridge ifname br0 con-name br0
sudo nmcli connection add type bridge-slave ifname enp3s0 master br0
sudo nmcli connection up br0

VLAN tag

A VLAN splits one cable into several networks that your switch keeps apart. A VM tagged with VLAN 20 sees only the other machines on VLAN 20. Whether VLAN 20 can talk to VLAN 30 is up to your router and its firewall, not Nano Cloud.

Your network has to be set up for it. The host's switch port must carry tagged VLANs, and something on each VLAN, usually the router, must hand out addresses. On an ordinary home network a tagged VM gets no address.

You don't have to set up a bridge for this. On the port that carries the host's default route, Nano Cloud adds a VLAN link and a bridge for it, such as enp3s0.20 and nc-vlan20. It gives them no address and leaves the port's own settings alone. They don't survive a reboot; Nano Cloud makes them again when it starts a VM that needs them.

Changing it later

You can change a VM's network on its Network tab. The guest picks it up the next time it boots, and the tab says Restart to apply until the VM has been stopped and started. On a new network it will usually get a new address.