[SOLVED] Adding a second public IP range

[Paspao]

Hello,

my cluster shares a public IP range assigned to bridge in a very simple config:

iface vmbr0 inet static
address 5.X.X.1 # each node has his own IP from within the range.
netmask 255.255.255.0
gateway 5.X.X.254
bridge_ports eno1
bridge_stp off
bridge_fd 0

I need to add another new IP range and I want to keep the possibility to assign IPs in new range to VM in all nodes.

Do I have to create a new Bridge vmbr1 or it is possible to add new range to the same bridge with routing like:

up ip route add 6.X.X.0/24 dev vmbr0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward

Are there any pros and cons?

I would like to use the same NIC interface eno1.

Thank you.
P.

 

[Stoiko Ivanov]

Hello,

Checkout the debian documentation on the subject: https://wiki.debian.org/NetworkConfiguration#Multiple_IP_addresses_on_one_Interface
(the iproute2 method should work and be more futureproof)

Hope this helps!

 

[Paspao]

Hello Stoiko,

thank you for your reply.

The Debian page has simple examples with IPs in the same subnet and without bridge involved.

My case is with a bridge and a new subnet with its gateway address.

I think adding the iproute and ip_forward lines to bridge config could be enough to make it work but my doubts are:

- Using GW of first range is OK ?
- I know that enabling ip_forward is related to security issues. Which are the security aspects to check in a Proxmox cluster with forwardiing enabled?

Thank you
P.

 

[Stoiko Ivanov]

My case is with a bridge and a new subnet with its gateway address.

You cannot (simply) have 2 'gateways' a.k.a default routes.
It's always only one which will be used (and if it's for the same prefix (default route is simply the route for 0.0.0.0/0) you will even get an error)

Did you try simply adding your second ip as alias to your vmbr0 ? (you should not need to enable ip-forwarding for that)

as far as security is concerned - usually in the regular setups a bridge acts like a layer2 switch and forwards frames (i.e. the VMs are directly connected to the network and can speak with it) with ip-forwarding you allow your node to be a layer3 switch (this is needed for masquerading setups)

- Using GW of first range is OK ?

This depends on the configuration of your/your provider's network (in most simple cases I know it works without problems)

check out the reference documentation on networks - it describes these situation : https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_network_configuration

Hope this helps!

 

[Paspao]

I just have received the range assigned by ISP and I confirm it works:

echo 1 > /proc/sys/net/ipv4/ip_forward

ip route add X.Y.Z.0/24 dev vmbr0

Created a new LXC with IP X.Y.Z.10/32 and gateway in a different prefix A.B.C.254 (same as my vmbr0 default GW)

Simpler than I thought.

Thank you!

P.