Noob question: How to protect Proxmox Host from specific NIC access

M

mylesw

Renowned Member
Feb 10, 2011
87
3
73
Firstly, many thanks to all the great folk behind this incredible piece of tech. I'm migrating from VMWare ESXi to Proxmox and so far its been a relatively painless experience.

I do have one question (more for clarification). I have a server that I will be colocating it at our data center. We have both a WAN IP address (provided by the data center) for Internet access, and our own private LAN (for our management of hosts, backups, etc.). Both have entirely different network connections, and therefore on NIC is connected to the WAN and one NIC connected to the LAN. When I setup Proxmox it asked for a single IP address, mask & gateway. I was assuming this to be the private LAN identity of the box since that is how we will manage it, and so I've set it up that way.

The public WAN NIC and its IP addresses are typically only used for the VMs since I don't want to expose the Proxmox host to the Internet (I can get to it via VPN to the Private LAN and manage it from there if I need to). So I created two bridges - one for the LAN and one for the WAN. Both are associated with their respective NICs.

In this configuration, will it protect the Proxmox host from access to the 2nd NIC (the public WAN) since the IP address I gave it is not accessible via that bridge? And since I've created each VM with 2 IP addresses - one LAN and one WAN, does that simply mean that the VMs can be accessed via both NICs/networks, but not the Proxmox host? Just want to be sure before I expose my host to the WAN and get pwned in the process.

I shouldn't need to SSH to the host and start configuring networking at the command line for something like this, right? I mean its relatively simple and I think I've done everything according to Proxmox docs, etc.

Appreciate any clarification and I should be good to go.

Thanks
Myles
 
I think I might have found the secret here, which I completely didn't realize. I'm just testing this out, so I'm hopeful I'm on the right path.

If I setup Proxmox with a bridged network to my Private LAN, I can access the web console through that network just fine. When I setup a 2nd NIC with its own bridged network in the Proxmox System area, I then got access to the Proxmox web interface via the public Internet. Of course that is NOT what I want.

Then I realized, I don't need to assign an IP address to the 2nd NIC in the Proxmox host, but can assign it to the VMs, right? I mean the eth1 device will just be available to the VMs directly, so that is where I can set the IP addressing for the WAN.

Am I on the right track here?

Myles
 
mylesw said:
I think I might have found the secret here, which I completely didn't realize. I'm just testing this out, so I'm hopeful I'm on the right path.

If I setup Proxmox with a bridged network to my Private LAN, I can access the web console through that network just fine. When I setup a 2nd NIC with its own bridged network in the Proxmox System area, I then got access to the Proxmox web interface via the public Internet. Of course that is NOT what I want.

Then I realized, I don't need to assign an IP address to the 2nd NIC in the Proxmox host, but can assign it to the VMs, right? I mean the eth1 device will just be available to the VMs directly, so that is where I can set the IP addressing for the WAN.

Am I on the right track here?

Myles
Click to expand...
Hi Myles,
right - only vmbr0 need an ip-address. For other bridges it's enough if the traffic handle the VMs inside.

Udo
 
You must log in or register to reply here.
Top Bottom