Set up tap-device networking for a Firecracker microVM (host tap, NAT, guest IP via API or kernel boot args)

Documented steps

1. Create and bring up the tap on the host: `sudo ip tuntap add tap0 mode tap && sudo ip addr add 172.16.0.1/30 dev tap0 && sudo ip link set tap0 up` — the tap's IP must NOT be in the same subnet as the host's own IP.
2. Enable forwarding: `echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward`.
3. Add NAT rules, e.g. nftables: `sudo nft add table firecracker`, a postrouting NAT chain with `sudo nft add rule firecracker postrouting ip saddr 172.16.0.2 oifname eth0 counter masquerade`, and a forward rule `sudo nft add rule firecracker filter iifname tap0 oifname eth0 accept` (iptables-nft equivalents are in the doc).
4. Pre-boot, attach the interface: `curl --unix-socket /tmp/firecracker.socket -X PUT 'http://localhost/network-interfaces/my_network0' -d '{"iface_id": "my_network0", "guest_mac": "06:00:AC:10:00:02", "host_dev_name": "tap0"}'`.
5. Configure the guest IP either inside the guest (`ip addr add 172.16.0.2/30 dev eth0 && ip link set eth0 up && ip route add default via 172.16.0.1 dev eth0`) or via kernel boot args with no iproute2 needed: append `ip=172.16.0.2::172.16.0.1:255.255.255.252::eth0:off`.
6. Set guest DNS: add `nameserver 8.8.8.8` to /etc/resolv.conf in the guest.
7. For multiple guests, repeat with a new tap, a new /30 subnet, and per-VM NAT rules; clean up with `sudo ip link del tap0` plus rule deletion, and disable ip_forward only when no guests remain.
8. Official doc: https://github.com/firecracker-microvm/firecracker/blob/main/docs/network-setup.md