Proxmox Network Recommendations

Current Setup

Home network: 10.5.1.0/24
Proxmox host: 10.5.1.10 (static)
Single NIC, vmbr0 bridged to LAN
VMs on the same /24 via DHCP

Home Router (10.5.1.1)
      |
  [LAN: 10.5.1.0/24]
      |
  Proxmox (10.5.1.10) — vmbr0 bridged to LAN
      |
  VMs (DHCP from home router, flat network)

Problem: VMs, Proxmox management UI (port 8006), and all LAN devices share the same flat network — no isolation.

Best Practice Tiers

Tier 1 — Minimal (single NIC, no managed switch)

Add a second internal bridge for isolated VMs. Keep vmbr0 for LAN-facing VMs.

vmbr0  → bridged to NIC → 10.5.1.0/24 (LAN, trusted VMs)
vmbr1  → internal only  → 10.5.2.0/24 (isolated VMs + NAT)

Add to /etc/network/interfaces:

auto vmbr1
iface vmbr1 inet static
    address 10.5.2.1/24
    bridge-ports none
    bridge-stp off
    post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up   iptables -t nat -A POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE

Tradeoff: No special hardware needed. Proxmox web UI still reachable from entire LAN.

Tier 2 — VLAN Segmentation (single NIC + managed switch)

Make vmbr0 VLAN-aware. All VLANs over one physical NIC, router handles inter-VLAN routing.

VLAN	Purpose	Subnet
10	Proxmox management	10.5.10.0/24
20	Trusted VMs / LAN	10.5.20.0/24
30	IoT / untrusted	10.5.30.0/24
40	DMZ (internet-facing)	10.5.40.0/24

In Proxmox UI: set vmbr0 → VLAN aware, assign VLAN tag per VM.

Requires: managed switch + VLAN-capable router (OPNsense, pfSense, Unifi, TP-Link Omada, etc.).

Tier 3 — Firewall VM inside Proxmox

Run OPNsense or pfSense as a VM. Proxmox management gets its own isolated VLAN unreachable by guest VMs.

WAN → pfSense VM → routes between all VLANs → VMs
                 → Proxmox management VLAN (isolated)

Tradeoff: Most flexible, most complex. Worth it for internet-exposed services.

Recommended Setup: Two NICs (Physical Separation)

Physical separation is simpler and more secure than VLAN trunking at home lab scale.

NIC1 (enp1s0) → vmbr0 → Proxmox management only
                          host IP: 10.5.1.10
                          web UI + SSH — no VMs attached

NIC2 (enp2s0) → vmbr1 → VM traffic bridge
                          VMs get DHCP from home router
                          no host IP on this bridge

Security benefit: even if a VM is compromised, it has no path to the Proxmox management interface.

`/etc/network/interfaces`

auto lo
iface lo inet loopback

# Management — Proxmox host only
auto enp1s0
iface enp1s0 inet manual

auto vmbr0
iface vmbr0 inet static
    address 10.5.1.10/24
    gateway 10.5.1.1
    bridge-ports enp1s0
    bridge-stp off
    bridge-fd 0

# VM traffic — no IP on the bridge itself
auto enp2s0
iface enp2s0 inet manual

auto vmbr1
iface vmbr1 inet manual
    bridge-ports enp2s0
    bridge-stp off
    bridge-fd 0

NIC2 must connect to a regular untagged LAN port on your switch/router so VMs continue to receive DHCP from the home router on 10.5.1.0/24.

Terraform — update the network bridge

In main.tf, change bridge from vmbr0 to vmbr1 for both resource blocks:

network {
  id     = 0
  bridge = "vmbr1"
  model  = "virtio"
}

No router changes needed — VMs still get 10.5.1.x addresses via DHCP as before.

Summary

Option	Hardware needed	Isolation	Complexity
Tier 1 (NAT bridge)	None	Partial	Low
Tier 2 (VLANs)	Managed switch	Good	Medium
Tier 3 (Firewall VM)	None extra	Excellent	High
Two NICs (chosen)	Second NIC	Good, simple	Low

3.9 KiB Raw Blame History