Normally qemu uses user network/10.0.2.x by default.
For network bridge with TAP/192.168.122.x, you need create TAP interface by ROOT.
############## Get list of support net device from qemu
lake@lake-Latitude-5491:~/qemu$ qemu-system-x86_64 -net nic,model=?
qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.vmx [bit 5]
qemu: Supported NIC models: ne2k_pci,i82551,i82557b,i82559er,rtl8139,e1000,pcnet,virtio,sungem
1. Host bridge interface
virbr0 is defined in /etc/libvirt/qemu/networks/default.xml
lake@lake-Latitude-5491:~/qemu$ ifconfig virbr0
virbr0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 192.168.122.1 netmask 255.255.255.0 broadcast 192.168.122.255
ether 52:54:00:c8:b6:a2 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lake@lake-Latitude-5491:~/qemu$ virsh net-list
Name State Autostart Persistent
----------------------------------------------------------
default active yes yes
2. root creats tap0 bridge interface
sudo tunctl -t tap0
sudo ifconfig tap0 0.0.0.0 up
sudo brctl addif virbr0 tap0
lake@lake-Latitude-5491:~/qemu$ ifconfig
tap0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 16:87:d6:59:02:ee txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
virbr0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 192.168.122.1 netmask 255.255.255.0 broadcast 192.168.122.255
ether 16:87:d6:59:02:ee txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
3. root starts qemu with network bridge/tap0
lake@lake-Latitude-5491:~/qemu$ sudo qemu-system-i386 -m 4086M -hda disk.img -netdev tap,id=tapnet,ifname=tap0,script=no -device rtl8139,netdev=tapnet
>>>>>>>>>>>>>> kernel log for virbr/tap
[72772.336763] virbr0: port 2(tap0) entered blocking state
[72772.336765] virbr0: port 2(tap0) entered disabled state
[72772.336847] device tap0 entered promiscuous mode
[72856.458187] IPv6: ADDRCONF(NETDEV_CHANGE): tap0: link becomes ready
[72856.458265] virbr0: port 2(tap0) entered blocking state
[72856.458266] virbr0: port 2(tap0) entered listening state
[72857.481263] virbr0: port 2(tap0) entered disabled state
[72896.336944] virbr0: port 2(tap0) entered blocking state
[72896.336945] virbr0: port 2(tap0) entered listening state
[72898.344631] virbr0: port 2(tap0) entered learning state
[72900.360459] virbr0: port 2(tap0) entered forwarding state
[72900.360465] virbr0: topology change detected, propagating
<<<<<<<<<<<<<<<<<<<<<<<<<<
4. Test network bridge TAP subnet/192.168.122.x
lake@lake-Latitude-5491:~/qemu$ ifconfig virbr0
virbr0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.122.1 netmask 255.255.255.0 broadcast 192.168.122.255
ether 16:87:d6:59:02:ee txqueuelen 1000 (Ethernet)
RX packets 18 bytes 1998 (1.9 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 16 bytes 2047 (2.0 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lake@lake-Latitude-5491:~/qemu$ ifconfig tap0
tap0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::1487:d6ff:fe59:2ee prefixlen 64 scopeid 0x20<link>
ether 16:87:d6:59:02:ee txqueuelen 1000 (Ethernet)
RX packets 18 bytes 2250 (2.2 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 93 bytes 6774 (6.7 KB)
TX errors 0 dropped 3 overruns 0 carrier 0 collisions 0
>>>>>>>>>>> 192.168.122.76 is qemu Guest IP
lake@lake-Latitude-5491:~/qemu$ ping 192.168.122.76
PING 192.168.122.76 (192.168.122.76) 56(84) bytes of data.
64 bytes from 192.168.122.76: icmp_seq=1 ttl=128 time=4.14 ms
64 bytes from 192.168.122.76: icmp_seq=2 ttl=128 time=1.37 ms
lake@lake-Latitude-5491:~/qemu$ brctl show
bridge name bridge id STP enabled interfaces
virbr0 8000.1687d65902ee yes tap0
virbr0-nic