Configure SDN for internal and external zones

[jlm]

We are using the following version of Proxmox:

# pveversion
pve-manager/9.2.5/20242970da7fbcef (running kernel: 7.0.14-6-pve)

Our Proxmox datacentre consists of a single node, intended for our DMZ and thus isolated from the rest of our infrastructure. The management interface was created via Ansible using teaming, so it is not a bond. As a result, it does not appear in the Proxmox web interface.

cat /etc/network/interfaces.d/team0.conf
auto team0
iface team0 inet static
pre-up /usr/bin/teamd -d -o -f /etc/network/teamd-team0.conf
post-down /usr/bin/teamd -k -t team0
address  192.168.199.1/28
gateway 192.168.199.14


# iface team0 inet6 static
# address
# gateway
# dad-interval 0.2

Containers and virtual machines are accessible via a vmbr (vmbr1) corresponding to a single physical network interface, nic2. This interface is connected to an unmanaged switch, which in turn connects to the DMZ port of our firewall. The single VLAN is in access mode, so it is untagged.

# cat /etc/network/interfaces
auto lo
iface lo inet loopback
iface nic0 inet manual
iface nic1 inet manual
iface nic2 inet manual
iface nic3 inet manual


auto vmbr1
iface vmbr1 inet manual
bridge-ports nic2
bridge-stp off
bridge-fd 0

We use Proxmox SDN.
Here, we want to create two zones: an external network with public IPs for the frontends (VLAN Zone) and an internal network (Simple Zone).

# cat /etc/network/interfaces.d/sdn
#version:9


auto internal
iface internal
address 192.168.120.254/24
post-up iptables -t nat -A POSTROUTING -s '192.168.120.0/24' -o team0 -j SNAT --to-source 192.168.199.1
post-down iptables -t nat -D POSTROUTING -s '192.168.120.0/24' -o team0 -j SNAT --to-source 192.168.199.1
post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
bridge_ports none
bridge_stp off
bridge_fd 0
alias Internal Vnet
ip-forward on


auto external
iface external
address 192.0.2.0/24
bridge_ports none
bridge_stp off
bridge_fd 0
alias External Vlan
ip-forward on

As you can see, the internal network (Simple Zone) uses team0, which is our management network, rather than vmbr1, the bridge for the VMs.

How can we correct this?
Editing the file is automatically overwritten when refreshing the SDN.

Are the following Vnet configurations correct ?

/etc/pve/sdn/subnets.cfg
subnet: internal-192.168.120.0-24
vnet dmzint
dnszoneprefix example.com
gateway 192.168.120.254
snat 1


subnet: external-192.0.2.0-24
vnet dmzext
gateway 192.0.2.254


/etc/pve/sdn/vnets.cfg
vnet: dmzint
zone internal
alias Vnet dmzint
isolate-ports 1


vnet: dmzext
zone external
alias External Vlan


/etc/pve/sdn/zones.cfg
simple: internal
dhcp dnsmasq
ipam pve


simple: external
ipam pve

regards

 

[jlm]

I have made modifications to my SDN configuration on the new Proxmox cluster, named current configuration.

My two zones, internal and external, are now VLAN zones.

The SDN configuration I am using is standard and already works on another Proxmox cluster. For clarity, I will refer to it as the classic configuration.
The only difference is that my classic configuration exits through a physical interface on the Proxmox server, where I have a VLAN trunk. The VLAN untagging is handled by a physical switch that takes the trunk as input and outputs to network ports in access mode.

For my current configuration on the new cluster, I am using the same setup, except here I do not have a physical switch to untag the VLANs. The untagging must be done by a virtual switch within Proxmox. This is the part I cannot configure.

Here is my current SDN configuration:

/etc/network/interfaces
...
auto vmbr1
iface vmbr1 inet manual
        bridge-ports nic2
        bridge-stp off
        bridge-fd 0

/etc/pve/sdn/subnets.cfg
subnet: externe-192.0.2.0-24
        vnet dmzext
        dnszoneprefix example.com
        gateway 192.0.2.254

subnet: interne-192.168.120.0-24
        vnet dmzint
        dnszoneprefix example.com
        gateway 192.168.120.254
        bridge-fd 0

/etc/pve/sdn/vnets.cfg
vnet: dmzext
        zone externe
        tag 2

vnet: dmzint
        zone interne
        tag 120
        bridge-fd 0

/etc/pve/sdn/zones.cfg
vlan: externe
        bridge vmbr1
        ipam pve

vlan: interne
        bridge vmbr1
        ipam pve
        bridge-fd 0