Dmitry Sergeev
153 lines
3.9 KiB
Markdown
153 lines
3.9 KiB
Markdown
# Proxmox Network Recommendations
|
|
|
|
## Current Setup
|
|
|
|
- Home network: `10.5.1.0/24`
|
|
- Proxmox host: `10.5.1.10` (static)
|
|
- Single NIC, `vmbr0` bridged to LAN
|
|
- VMs on the same `/24` via DHCP
|
|
|
|
```
|
|
Home Router (10.5.1.1)
|
|
|
|
|
[LAN: 10.5.1.0/24]
|
|
|
|
|
Proxmox (10.5.1.10) — vmbr0 bridged to LAN
|
|
|
|
|
VMs (DHCP from home router, flat network)
|
|
```
|
|
|
|
Problem: VMs, Proxmox management UI (port 8006), and all LAN devices share the same flat network — no isolation.
|
|
|
|
---
|
|
|
|
## Best Practice Tiers
|
|
|
|
### Tier 1 — Minimal (single NIC, no managed switch)
|
|
|
|
Add a second internal bridge for isolated VMs. Keep `vmbr0` for LAN-facing VMs.
|
|
|
|
```
|
|
vmbr0 → bridged to NIC → 10.5.1.0/24 (LAN, trusted VMs)
|
|
vmbr1 → internal only → 10.5.2.0/24 (isolated VMs + NAT)
|
|
```
|
|
|
|
Add to `/etc/network/interfaces`:
|
|
|
|
```
|
|
auto vmbr1
|
|
iface vmbr1 inet static
|
|
address 10.5.2.1/24
|
|
bridge-ports none
|
|
bridge-stp off
|
|
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
|
|
post-up iptables -t nat -A POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE
|
|
post-down iptables -t nat -D POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE
|
|
```
|
|
|
|
**Tradeoff:** No special hardware needed. Proxmox web UI still reachable from entire LAN.
|
|
|
|
---
|
|
|
|
### Tier 2 — VLAN Segmentation (single NIC + managed switch)
|
|
|
|
Make `vmbr0` VLAN-aware. All VLANs over one physical NIC, router handles inter-VLAN routing.
|
|
|
|
| VLAN | Purpose | Subnet |
|
|
|------|---------------------|-----------------|
|
|
| 10 | Proxmox management | 10.5.10.0/24 |
|
|
| 20 | Trusted VMs / LAN | 10.5.20.0/24 |
|
|
| 30 | IoT / untrusted | 10.5.30.0/24 |
|
|
| 40 | DMZ (internet-facing) | 10.5.40.0/24 |
|
|
|
|
In Proxmox UI: set `vmbr0` → **VLAN aware**, assign VLAN tag per VM.
|
|
|
|
**Requires:** managed switch + VLAN-capable router (OPNsense, pfSense, Unifi, TP-Link Omada, etc.).
|
|
|
|
---
|
|
|
|
### Tier 3 — Firewall VM inside Proxmox
|
|
|
|
Run OPNsense or pfSense as a VM. Proxmox management gets its own isolated VLAN unreachable by guest VMs.
|
|
|
|
```
|
|
WAN → pfSense VM → routes between all VLANs → VMs
|
|
→ Proxmox management VLAN (isolated)
|
|
```
|
|
|
|
**Tradeoff:** Most flexible, most complex. Worth it for internet-exposed services.
|
|
|
|
---
|
|
|
|
## Recommended Setup: Two NICs (Physical Separation)
|
|
|
|
Physical separation is simpler and more secure than VLAN trunking at home lab scale.
|
|
|
|
```
|
|
NIC1 (enp1s0) → vmbr0 → Proxmox management only
|
|
host IP: 10.5.1.10
|
|
web UI + SSH — no VMs attached
|
|
|
|
NIC2 (enp2s0) → vmbr1 → VM traffic bridge
|
|
VMs get DHCP from home router
|
|
no host IP on this bridge
|
|
```
|
|
|
|
**Security benefit:** even if a VM is compromised, it has no path to the Proxmox management interface.
|
|
|
|
### `/etc/network/interfaces`
|
|
|
|
```
|
|
auto lo
|
|
iface lo inet loopback
|
|
|
|
# Management — Proxmox host only
|
|
auto enp1s0
|
|
iface enp1s0 inet manual
|
|
|
|
auto vmbr0
|
|
iface vmbr0 inet static
|
|
address 10.5.1.10/24
|
|
gateway 10.5.1.1
|
|
bridge-ports enp1s0
|
|
bridge-stp off
|
|
bridge-fd 0
|
|
|
|
# VM traffic — no IP on the bridge itself
|
|
auto enp2s0
|
|
iface enp2s0 inet manual
|
|
|
|
auto vmbr1
|
|
iface vmbr1 inet manual
|
|
bridge-ports enp2s0
|
|
bridge-stp off
|
|
bridge-fd 0
|
|
```
|
|
|
|
NIC2 must connect to a regular untagged LAN port on your switch/router so VMs continue to receive DHCP from the home router on `10.5.1.0/24`.
|
|
|
|
### Terraform — update the network bridge
|
|
|
|
In `main.tf`, change `bridge` from `vmbr0` to `vmbr1` for both resource blocks:
|
|
|
|
```hcl
|
|
network {
|
|
id = 0
|
|
bridge = "vmbr1"
|
|
model = "virtio"
|
|
}
|
|
```
|
|
|
|
No router changes needed — VMs still get `10.5.1.x` addresses via DHCP as before.
|
|
|
|
---
|
|
|
|
## Summary
|
|
|
|
| Option | Hardware needed | Isolation | Complexity |
|
|
|--------|----------------|-----------|------------|
|
|
| Tier 1 (NAT bridge) | None | Partial | Low |
|
|
| Tier 2 (VLANs) | Managed switch | Good | Medium |
|
|
| Tier 3 (Firewall VM) | None extra | Excellent | High |
|
|
| **Two NICs** (chosen) | Second NIC | **Good, simple** | **Low** |
|