# Proxmox Network Recommendations

## Current Setup

- Home network: `10.5.1.0/24`
- Proxmox host: `10.5.1.10` (static)
- Single NIC, `vmbr0` bridged to LAN
- VMs on the same `/24` via DHCP

```
Home Router (10.5.1.1)
      |
  [LAN: 10.5.1.0/24]
      |
  Proxmox (10.5.1.10) — vmbr0 bridged to LAN
      |
  VMs (DHCP from home router, flat network)
```

Problem: VMs, Proxmox management UI (port 8006), and all LAN devices share the same flat network — no isolation.

---

## Best Practice Tiers

### Tier 1 — Minimal (single NIC, no managed switch)

Add a second internal bridge for isolated VMs. Keep `vmbr0` for LAN-facing VMs.

```
vmbr0  → bridged to NIC → 10.5.1.0/24 (LAN, trusted VMs)
vmbr1  → internal only  → 10.5.2.0/24 (isolated VMs + NAT)
```

Add to `/etc/network/interfaces`:

```
auto vmbr1
iface vmbr1 inet static
    address 10.5.2.1/24
    bridge-ports none
    bridge-stp off
    post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up   iptables -t nat -A POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE
```

**Tradeoff:** No special hardware needed. Proxmox web UI still reachable from entire LAN.

---

### Tier 2 — VLAN Segmentation (single NIC + managed switch)

Make `vmbr0` VLAN-aware. All VLANs over one physical NIC, router handles inter-VLAN routing.

| VLAN | Purpose             | Subnet          |
|------|---------------------|-----------------|
| 10   | Proxmox management  | 10.5.10.0/24    |
| 20   | Trusted VMs / LAN   | 10.5.20.0/24    |
| 30   | IoT / untrusted     | 10.5.30.0/24    |
| 40   | DMZ (internet-facing) | 10.5.40.0/24  |

In Proxmox UI: set `vmbr0` → **VLAN aware**, assign VLAN tag per VM.

**Requires:** managed switch + VLAN-capable router (OPNsense, pfSense, Unifi, TP-Link Omada, etc.).

---

### Tier 3 — Firewall VM inside Proxmox

Run OPNsense or pfSense as a VM. Proxmox management gets its own isolated VLAN unreachable by guest VMs.

```
WAN → pfSense VM → routes between all VLANs → VMs
                 → Proxmox management VLAN (isolated)
```

**Tradeoff:** Most flexible, most complex. Worth it for internet-exposed services.

---

## Recommended Setup: Two NICs (Physical Separation)

Physical separation is simpler and more secure than VLAN trunking at home lab scale.

```
NIC1 (enp1s0) → vmbr0 → Proxmox management only
                          host IP: 10.5.1.10
                          web UI + SSH — no VMs attached

NIC2 (enp2s0) → vmbr1 → VM traffic bridge
                          VMs get DHCP from home router
                          no host IP on this bridge
```

**Security benefit:** even if a VM is compromised, it has no path to the Proxmox management interface.

### `/etc/network/interfaces`

```
auto lo
iface lo inet loopback

# Management — Proxmox host only
auto enp1s0
iface enp1s0 inet manual

auto vmbr0
iface vmbr0 inet static
    address 10.5.1.10/24
    gateway 10.5.1.1
    bridge-ports enp1s0
    bridge-stp off
    bridge-fd 0

# VM traffic — no IP on the bridge itself
auto enp2s0
iface enp2s0 inet manual

auto vmbr1
iface vmbr1 inet manual
    bridge-ports enp2s0
    bridge-stp off
    bridge-fd 0
```

NIC2 must connect to a regular untagged LAN port on your switch/router so VMs continue to receive DHCP from the home router on `10.5.1.0/24`.

### Terraform — update the network bridge

In `main.tf`, change `bridge` from `vmbr0` to `vmbr1` for both resource blocks:

```hcl
network {
  id     = 0
  bridge = "vmbr1"
  model  = "virtio"
}
```

No router changes needed — VMs still get `10.5.1.x` addresses via DHCP as before.

---

## Summary

| Option | Hardware needed | Isolation | Complexity |
|--------|----------------|-----------|------------|
| Tier 1 (NAT bridge) | None | Partial | Low |
| Tier 2 (VLANs) | Managed switch | Good | Medium |
| Tier 3 (Firewall VM) | None extra | Excellent | High |
| **Two NICs** (chosen) | Second NIC | **Good, simple** | **Low** |