terraform oldmac

2026-07-23 21:53:15 +03:00
parent dd39045d6d
commit cc77e7464b
5 changed files with 293 additions and 0 deletions
@@ -0,0 +1,152 @@
+# Proxmox Network Recommendations
+
+## Current Setup
+
+- Home network: `10.5.1.0/24`
+- Proxmox host: `10.5.1.10` (static)
+- Single NIC, `vmbr0` bridged to LAN
+- VMs on the same `/24` via DHCP
+
+```
+Home Router (10.5.1.1)
+      |
+  [LAN: 10.5.1.0/24]
+      |
+  Proxmox (10.5.1.10) — vmbr0 bridged to LAN
+      |
+  VMs (DHCP from home router, flat network)
+```
+
+Problem: VMs, Proxmox management UI (port 8006), and all LAN devices share the same flat network — no isolation.
+
+---
+
+## Best Practice Tiers
+
+### Tier 1 — Minimal (single NIC, no managed switch)
+
+Add a second internal bridge for isolated VMs. Keep `vmbr0` for LAN-facing VMs.
+
+```
+vmbr0  → bridged to NIC → 10.5.1.0/24 (LAN, trusted VMs)
+vmbr1  → internal only  → 10.5.2.0/24 (isolated VMs + NAT)
+```
+
+Add to `/etc/network/interfaces`:
+
+```
+auto vmbr1
+iface vmbr1 inet static
+    address 10.5.2.1/24
+    bridge-ports none
+    bridge-stp off
+    post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
+    post-up   iptables -t nat -A POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE
+    post-down iptables -t nat -D POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE
+```
+
+**Tradeoff:** No special hardware needed. Proxmox web UI still reachable from entire LAN.
+
+---
+
+### Tier 2 — VLAN Segmentation (single NIC + managed switch)
+
+Make `vmbr0` VLAN-aware. All VLANs over one physical NIC, router handles inter-VLAN routing.
+
+| VLAN | Purpose             | Subnet          |
+|------|---------------------|-----------------|
+| 10   | Proxmox management  | 10.5.10.0/24    |
+| 20   | Trusted VMs / LAN   | 10.5.20.0/24    |
+| 30   | IoT / untrusted     | 10.5.30.0/24    |
+| 40   | DMZ (internet-facing) | 10.5.40.0/24  |
+
+In Proxmox UI: set `vmbr0` → **VLAN aware**, assign VLAN tag per VM.
+
+**Requires:** managed switch + VLAN-capable router (OPNsense, pfSense, Unifi, TP-Link Omada, etc.).
+
+---
+
+### Tier 3 — Firewall VM inside Proxmox
+
+Run OPNsense or pfSense as a VM. Proxmox management gets its own isolated VLAN unreachable by guest VMs.
+
+```
+WAN → pfSense VM → routes between all VLANs → VMs
+                 → Proxmox management VLAN (isolated)
+```
+
+**Tradeoff:** Most flexible, most complex. Worth it for internet-exposed services.
+
+---
+
+## Recommended Setup: Two NICs (Physical Separation)
+
+Physical separation is simpler and more secure than VLAN trunking at home lab scale.
+
+```
+NIC1 (enp1s0) → vmbr0 → Proxmox management only
+                          host IP: 10.5.1.10
+                          web UI + SSH — no VMs attached
+
+NIC2 (enp2s0) → vmbr1 → VM traffic bridge
+                          VMs get DHCP from home router
+                          no host IP on this bridge
+```
+
+**Security benefit:** even if a VM is compromised, it has no path to the Proxmox management interface.
+
+### `/etc/network/interfaces`
+
+```
+auto lo
+iface lo inet loopback
+
+# Management — Proxmox host only
+auto enp1s0
+iface enp1s0 inet manual
+
+auto vmbr0
+iface vmbr0 inet static
+    address 10.5.1.10/24
+    gateway 10.5.1.1
+    bridge-ports enp1s0
+    bridge-stp off
+    bridge-fd 0
+
+# VM traffic — no IP on the bridge itself
+auto enp2s0
+iface enp2s0 inet manual
+
+auto vmbr1
+iface vmbr1 inet manual
+    bridge-ports enp2s0
+    bridge-stp off
+    bridge-fd 0
+```
+
+NIC2 must connect to a regular untagged LAN port on your switch/router so VMs continue to receive DHCP from the home router on `10.5.1.0/24`.
+
+### Terraform — update the network bridge
+
+In `main.tf`, change `bridge` from `vmbr0` to `vmbr1` for both resource blocks:
+
+```hcl
+network {
+  id     = 0
+  bridge = "vmbr1"
+  model  = "virtio"
+}
+```
+
+No router changes needed — VMs still get `10.5.1.x` addresses via DHCP as before.
+
+---
+
+## Summary
+
+| Option | Hardware needed | Isolation | Complexity |
+|--------|----------------|-----------|------------|
+| Tier 1 (NAT bridge) | None | Partial | Low |
+| Tier 2 (VLANs) | Managed switch | Good | Medium |
+| Tier 3 (Firewall VM) | None extra | Excellent | High |
+| **Two NICs** (chosen) | Second NIC | **Good, simple** | **Low** |