Is it possible to “give away” a network card to a virtual machine so that the host system does not see it?

Question

linux

Good afternoon. Such a question - Is it possible to "give" a network card to a virtual machine? Fedora 23 host OS, 2nd network card installed:

2: enp4s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether e8:de:27:01:02:e1 brd ff:ff:ff:ff:ff:ff
3: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:22:15:6a:eb:fd brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.72/24 brd 192.168.2.255 scope global enp2s0
       valid_lft forever preferred_lft forever

Is it possible to give it to the enp4s0 virtual machine on which Windows is installed, while it is desirable that the host system not "see" (send packets) it? The virtual machine will be connected to a different subnet.

Answer 1

Yes, you can. Bridge, it's called. In the host system, you need to remove the IP address from the virtaulka.

Answer 2

Only one card is configured on the host machine.
There is no need to forward the device on KVM.
Suppose you have 1 local interface 2 provider interface.
You can raise many virtual machines,
some will look at the local area, for example, the internal jabber,
others will look at the Internet, for example, a mail server.
the third will be both there and there, for example, a router and a proxy server.
Just assign network interfaces through the virtual manager and you don't need to do a bridge.

Answer 3

That's just the bridge will be software , that is, the host sees, reads and is attacked by an exchange with a virtual machine. This should probably be thrown as a pci device, but then the risk of capturing the host with a virtual machine. But you can forward usb... Maybe you can't hack the host from USB...
brctrl
...