How do you create a network bridge for virtual machines on a current Ubuntu, given the desktop tools will not do it?

The renderer can be set per device, which is the detail that unlocks this and is rarely mentioned:

network:
  version: 2
  ethernets:
    enp1s0:
      renderer: NetworkManager
      dhcp4: false
  bridges:
    br0:
      renderer: NetworkManager
      interfaces: [enp1s0]
      dhcp4: true
      parameters:
        stp: false
        forward-delay: 0

Two things worth knowing about that parameters block, because a bridge that works and then behaves strangely usually needs them.

forward-delay is a pause before the bridge starts passing traffic. With the default, a machine can come up, request an address, and get no answer because the bridge is still waiting. Setting it to zero fixes the boot-time race that makes a bridge look intermittent.

stp is the loop-prevention protocol. On a simple host bridge with one physical port there is no loop to prevent, and leaving it on adds delay.

The confusion in those guides is real and it comes from one fact: there are two things that can be in charge of an interface, and on a desktop install it is usually not the one the server guides assume.

The configuration format is the same either way — a YAML file describing the network — but it is handed to a renderer, and there are two:

• networkd, the default on server installs.
• NetworkManager, the default on desktop installs, because that is what the graphical settings drive.

A guide that writes a configuration and restarts the wrong one appears to do nothing. That is why half the tutorials seem broken.

So step one is finding out which renderer your machine uses. Look at the existing configuration files — the shipped one names the renderer, and a desktop install almost always names NetworkManager. Whatever you write must use the same one, or you must set it explicitly for your device.

On not locking yourself out — take this seriously, because a bridge configuration reassigns the interface you are connected through.

Use the try mode. The tool has a command that applies the configuration and automatically reverts it after a timeout unless you confirm. If the change breaks your connection, you cannot confirm, and it puts everything back. This exists for precisely this situation and it has saved me more than once.

Have a second route in if the machine is remote — a console, a second interface, physical access. On a desktop you are sitting in front of it, so this matters less.

Keep a copy of the working configuration before editing.

And validate the YAML before applying anything. Indentation errors in this format are silent about what they mean and produce a machine with no network at all.

One thing to check before building any of this: whether your interface is wireless.

Bridging a wireless interface generally does not work, because access points expect one address per client and a bridge presents several. Guides rarely say so and people spend an evening on it.

If the host is on wifi, the realistic options are NAT for the virtual machines, or a routed setup with proxy ARP, or a cable. It is the one case where the answer is that the thing you are trying to do is not available rather than not configured.