private gateway attach to wrong physical network

[weizhouapache]

Discussed in #11795

^{Originally posted by bradh352 October 6, 2025}
I've got these physical networks:

And I want to add a private gateway to access the mgmt network to allow access to few ports (ceph via the mgmt/hypervisor network in this case):

Before I attempt to add a private gateway, I check my network bridges:

ceph		8000.de95ff0e22c3	no		vxlan200
hypervisor		8000.0625c5991a54	no		vxlan100
public		8000.d286dc39fb05	no		vnet1
							vxlan2

I can see vnet1 for my VPC public ips attached to public which is right. But otherwise no vnets are attached to those bridges which is right as well.

So I create a private gateway in my VPC like this:

It creates fine, but when I look at bridge config, it attached to the wrong network!

ceph		8000.de95ff0e22c3	no		vxlan200
hypervisor		8000.0625c5991a54	no		vxlan100
public		8000.d286dc39fb05	no		vnet1
							vnet11
							vxlan2

I would have expected vnet11 to attach to hypervisor but instead it attached to public. Am I doing something wrong here? Or misunderstanding something? Or is this a bug?

I'm running 4.21.0

[weizhouapache]

I can reproduce the issue

I have two physical networks: cloudbr0 (mgmt) and cloudbr1 (guest/public)

• create private gw with vlan 102 on mgmt, the NIC is attached to breth0-102 (correct)
• create private gw with vlan 103 on guest/public, the NIC is attached to breth1-103 (correct)
• create private gw with untagged on mgmt, the NIC is attached to cloudbr1 (incorrect, should br cloudbr0)
• create private gw with untagged on guest/public, the NIC is attached to cloudbr1 (correct)

[weizhouapache]

if the private gw has a vlan tag, ACS creates a bridge on private nic (which is cloudbr0 in my setting)

private.network.device=cloudbr0

cloudstack/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BridgeVifDriver.java

Line 239 in 9bcd988

String brName = createVnetBr(vNetId, _bridges.get("private"), protocol);

however, if private gw does not have a vlan tag (in another word, it uses vlan://untagged), ACS creates a bridge on guest nic

cloudstack/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BridgeVifDriver.java

Line 247 in 9bcd988

brname = _bridges.get("guest");

the root cause is that the network tag was not set for private gws on management network

I think it is a bug, but I do not have a workaround for now.

[DaanHoogland]

fixed in #11864