How to isolate a NIC to certain applications?

Hi all,

I have 3 Network Interface Cards on my system, the one is on-board, and the other 2 are on a PCIe card (dual adapter).

When I am using certain VMs (qemu/kvm) I would like to isolate an adapter so only the running VM is using it, pretty much like I am doing with certain CPU core.

systemctl set-property --runtime -- user.slice AllowedCPUs=C8-15,24-31

I know I can isolate them using user.slice, but I haven’t been able to find a proper guide on how to.

And, yes, I know about device pass-through, but unfortunately, IOMMU- groups do not help…

My system:

System:
  Host: wizzy-manjaro-kde6 Kernel: 6.6.32-1-MANJARO arch: x86_64 bits: 64
  Desktop: KDE Plasma v: 6.0.5 Distro: Manjaro Linux
Machine:
  Type: Desktop System: Gigabyte product: X670E AORUS MASTER v: -CF
    serial: <superuser required>
  Mobo: Gigabyte model: X670E AORUS MASTER serial: <superuser required>
    UEFI: American Megatrends LLC. v: F21 date: 01/10/2024
CPU:
  Info: 16-core model: AMD Ryzen 9 7950X3D bits: 64 type: MT MCP cache:
    L2: 16 MiB
  Speed (MHz): avg: 1704 min/max: 400/5759 cores: 1: 4361 2: 3164 3: 400
    4: 400 5: 3165 6: 3818 7: 400 8: 4213 9: 400 10: 400 11: 3147 12: 3166
    13: 400 14: 400 15: 400 16: 4743 17: 400 18: 4411 19: 400 20: 400 21: 400
    22: 400 23: 3262 24: 400 25: 3164 26: 3164 27: 400 28: 3160 29: 400
    30: 400 31: 400 32: 400
Graphics:
  Device-1: NVIDIA AD103 [GeForce RTX 4080] driver: vfio-pci v: N/A
  Device-2: AMD Raphael driver: amdgpu v: kernel
  Device-3: Logitech HD Pro Webcam C920 driver: snd-usb-audio,uvcvideo
    type: USB
  Display: wayland server: X.org v: 1.21.1.13 with: Xwayland v: 24.1.0
    compositor: kwin_wayland driver: X: loaded: modesetting dri: radeonsi
    gpu: vfio-pci,amdgpu resolution: 1: 3440x1440 2: 1440x2560
  API: EGL v: 1.5 drivers: radeonsi,swrast
    platforms: wayland,x11,surfaceless,device
  API: OpenGL v: 4.6 compat-v: 4.5 vendor: amd mesa v: 24.0.9-manjaro1.1
    renderer: AMD Radeon Graphics (radeonsi raphael_mendocino LLVM 17.0.6 DRM
    3.54 6.6.32-1-MANJARO)
  API: Vulkan Message: No Vulkan data available.
Audio:
  Device-1: NVIDIA driver: vfio-pci
  Device-2: AMD Rembrandt Radeon High Definition Audio driver: snd_hda_intel
  Device-3: AMD Family 17h/19h HD Audio driver: snd_hda_intel
  Device-4: Logitech HD Pro Webcam C920 driver: snd-usb-audio,uvcvideo
    type: USB
  Device-5: Creative Sound Blaster X5
    driver: cdc_acm,hid-generic,snd-usb-audio,usbhid type: USB
  API: ALSA v: k6.6.32-1-MANJARO status: kernel-api
  Server-1: PipeWire v: 1.0.7 status: active
Network:
  Device-1: Intel 82576 Gigabit Network driver: igb
  IF: enp12s0f0 state: up speed: 1000 Mbps duplex: full
    mac: 98:b7:85:01:e3:3e
  Device-2: Intel 82576 Gigabit Network driver: igb
  IF: enp12s0f1 state: down mac: 98:b7:85:01:e3:3f
  Device-3: Intel Ethernet I225-V driver: igc
  IF: enp13s0 state: up speed: 1000 Mbps duplex: full mac: 74:56:3c:4b:74:7e
  Device-4: Intel Wi-Fi 6E AX210/AX1675 2x2 [Typhoon Peak] driver: iwlwifi
  IF: wlp14s0 state: down mac: c2:28:7b:ea:43:64
  IF-ID-1: virbr0 state: down mac: 52:54:00:3d:8b:7c
Bluetooth:
  Device-1: Intel AX210 Bluetooth driver: btusb type: USB
  Report: rfkill ID: hci0 rfk-id: 0 state: down bt-service: enabled,running
    rfk-block: hardware: no software: yes address: see --recommends
Drives:
  Local Storage: total: 5.52 TiB used: 1.13 TiB (20.4%)
  ID-1: /dev/nvme0n1 vendor: Kingston model: SKC3000D2048G size: 1.86 TiB
  ID-2: /dev/nvme1n1 vendor: Seagate model: XPG GAMMIX S50 Lite
    size: 953.87 GiB
  ID-3: /dev/nvme2n1 vendor: Samsung model: SSD 970 EVO 500GB
    size: 465.76 GiB
  ID-4: /dev/sda vendor: Crucial model: CT2000BX500SSD1 size: 1.82 TiB
  ID-5: /dev/sdb vendor: Samsung model: SSD 850 EVO 500GB size: 465.76 GiB
Partition:
  ID-1: / size: 448.43 GiB used: 22.55 GiB (5.0%) fs: ext4 dev: /dev/nvme2n1p2
  ID-2: /boot/efi size: 299.4 MiB used: 296 KiB (0.1%) fs: vfat
    dev: /dev/nvme2n1p1
Swap:
  ID-1: swap-1 type: partition size: 8.8 GiB used: 0 KiB (0.0%)
    dev: /dev/nvme2n1p3
Sensors:
  System Temperatures: cpu: 36.5 C mobo: N/A gpu: amdgpu temp: 33.0 C
  Fan Speeds (rpm): N/A
Info:
  Memory: total: 64 GiB note: est. available: 61.95 GiB
    used: 37.06 GiB (59.8%)
  Processes: 540 Uptime: 39m Shell: Zsh inxi: 3.3.35

NICs:

0c:00.0 Ethernet controller: Intel Corporation 82576 Gigabit Network Connection (rev 01)
	Subsystem: Intel Corporation Gigabit ET Dual Port Server Adapter
	Flags: bus master, fast devsel, latency 0, IRQ 24, IOMMU group 20
	Memory at a1000000 (32-bit, non-prefetchable) [size=128K]
	Memory at a0000000 (32-bit, non-prefetchable) [size=4M]
	I/O ports at e020 [disabled] [size=32]
	Memory at a1040000 (32-bit, non-prefetchable) [size=16K]
	Expansion ROM at a0400000 [disabled] [size=4M]
	Capabilities: <access denied>
	Kernel driver in use: igb
	Kernel modules: igb

0c:00.1 Ethernet controller: Intel Corporation 82576 Gigabit Network Connection (rev 01)
	Subsystem: Intel Corporation Gigabit ET Dual Port Server Adapter
	Flags: bus master, fast devsel, latency 0, IRQ 36, IOMMU group 20
	Memory at a1020000 (32-bit, non-prefetchable) [size=128K]
	Memory at a0800000 (32-bit, non-prefetchable) [size=4M]
	I/O ports at e000 [disabled] [size=32]
	Memory at a1084000 (32-bit, non-prefetchable) [size=16K]
	Expansion ROM at a0c00000 [disabled] [size=4M]
	Capabilities: <access denied>
	Kernel driver in use: igb
	Kernel modules: igb

0d:00.0 Ethernet controller: Intel Corporation Ethernet Controller I225-V (rev 01)
	Subsystem: Gigabyte Technology Co., Ltd Device e000
	Flags: bus master, fast devsel, latency 0, IRQ 38, IOMMU group 20
	Memory at a1200000 (32-bit, non-prefetchable) [size=1M]
	Memory at a1300000 (32-bit, non-prefetchable) [size=16K]
	Capabilities: <access denied>
	Kernel driver in use: igc
	Kernel modules: igc

0e:00.0 Network controller: Intel Corporation Wi-Fi 6E(802.11ax) AX210/AX1675* 2x2 [Typhoon Peak] (rev 1a)
	Subsystem: Intel Corporation Wi-Fi 6 AX210 160MHz
	Flags: bus master, fast devsel, latency 0, IRQ 44, IOMMU group 20
	Memory at a1400000 (64-bit, non-prefetchable) [size=16K]
	Capabilities: <access denied>
	Kernel driver in use: iwlwifi
	Kernel modules: iwlwifi

IOMMU groups:

IOMMU Group 20:
        04:08.0 PCI bridge [0604]: Advanced Micro Devices, Inc. [AMD] 600 Series Chipset PCIe Switch Downstream Port [1022:43f5] (rev 01)
        09:00.0 PCI bridge [0604]: Advanced Micro Devices, Inc. [AMD] 600 Series Chipset PCIe Switch Upstream Port [1022:43f4] (rev 01)
        0a:00.0 PCI bridge [0604]: Advanced Micro Devices, Inc. [AMD] 600 Series Chipset PCIe Switch Downstream Port [1022:43f5] (rev 01)
        0a:04.0 PCI bridge [0604]: Advanced Micro Devices, Inc. [AMD] 600 Series Chipset PCIe Switch Downstream Port [1022:43f5] (rev 01)
        0a:06.0 PCI bridge [0604]: Advanced Micro Devices, Inc. [AMD] 600 Series Chipset PCIe Switch Downstream Port [1022:43f5] (rev 01)
        0a:07.0 PCI bridge [0604]: Advanced Micro Devices, Inc. [AMD] 600 Series Chipset PCIe Switch Downstream Port [1022:43f5] (rev 01)
        0a:08.0 PCI bridge [0604]: Advanced Micro Devices, Inc. [AMD] 600 Series Chipset PCIe Switch Downstream Port [1022:43f5] (rev 01)
        0a:0c.0 PCI bridge [0604]: Advanced Micro Devices, Inc. [AMD] 600 Series Chipset PCIe Switch Downstream Port [1022:43f5] (rev 01)
        0a:0d.0 PCI bridge [0604]: Advanced Micro Devices, Inc. [AMD] 600 Series Chipset PCIe Switch Downstream Port [1022:43f5] (rev 01)
        0c:00.0 Ethernet controller [0200]: Intel Corporation 82576 Gigabit Network Connection [8086:10c9] (rev 01)
        0c:00.1 Ethernet controller [0200]: Intel Corporation 82576 Gigabit Network Connection [8086:10c9] (rev 01)
        0d:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller I225-V [8086:15f3] (rev 01)
        0e:00.0 Network controller [0280]: Intel Corporation Wi-Fi 6E(802.11ax) AX210/AX1675* 2x2 [Typhoon Peak] [8086:2725] (rev 1a)

I’d use systemd network namespaces and move one NIC to different namespace. It’s feature typically used to achieve data plane / management plane isolation on Linux. It allows you to isolate interface to separate namespace that only runs your selected systemd services.

I’m using it to run Nginx on separate data plane with separate gateway