We are using the following version of Proxmox:
Our Proxmox datacentre consists of a single node, intended for our DMZ and thus isolated from the rest of our infrastructure. The management interface was created via Ansible using teaming, so it is not a bond. As a result, it does not appear in the Proxmox web interface.
Containers and virtual machines are accessible via a vmbr corresponding to a single network interface, nic2. This is connected to an unmanaged switch, which in turn connects to the DMZ port of our firewall. The single VLAN is in access mode, so it is untagged.
We use Proxmox SDN.
Here, we want to create two zones: an external network with public IPs for the frontends (VLAN Zone) and an internal network (Simple Zone).
As you can see, the internal network (Simple Zone) uses team0, which is our management network, rather than vmbr1, the bridge for the VMs.
How can we correct this?
Editing the file is automatically overwritten when refreshing the SDN.
Are the following Vnet configurations correct ?
regards
Bash:
# pveversion
pve-manager/9.2.5/20242970da7fbcef (running kernel: 7.0.14-6-pve)Our Proxmox datacentre consists of a single node, intended for our DMZ and thus isolated from the rest of our infrastructure. The management interface was created via Ansible using teaming, so it is not a bond. As a result, it does not appear in the Proxmox web interface.
Bash:
cat /etc/network/interfaces.d/team0.conf
auto team0
iface team0 inet static
pre-up /usr/bin/teamd -d -o -f /etc/network/teamd-team0.conf
post-down /usr/bin/teamd -k -t team0
address 192.168.199.1/28
gateway 192.168.199.14
iface team0 inet6 static
address
gateway
#dad-interval 0.2Containers and virtual machines are accessible via a vmbr corresponding to a single network interface, nic2. This is connected to an unmanaged switch, which in turn connects to the DMZ port of our firewall. The single VLAN is in access mode, so it is untagged.
Bash:
# cat /etc/network/interfaces
auto lo
iface lo inet loopback
iface nic0 inet manual
iface nic1 inet manual
iface nic2 inet manual
iface nic3 inet manual
auto vmbr1
iface vmbr1 inet manual
bridge-ports nic2
bridge-stp off
bridge-fd 0Here, we want to create two zones: an external network with public IPs for the frontends (VLAN Zone) and an internal network (Simple Zone).
Bash:
# cat /etc/network/interfaces.d/sdn
#version:9
auto internal
iface internal
address 192.168.120.254/24
post-up iptables -t nat -A POSTROUTING -s '192.168.120.0/24' -o team0 -j SNAT --to-source 192.168.199.1
post-down iptables -t nat -D POSTROUTING -s '192.168.120.0/24' -o team0 -j SNAT --to-source 192.168.199.1
post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
bridge_ports none
bridge_stp off
bridge_fd 0
alias Internal Vnet
ip-forward on
auto external
iface external
address 192.0.2.0/24
bridge_ports none
bridge_stp off
bridge_fd 0
alias External Vlan
ip-forward onHow can we correct this?
Editing the file is automatically overwritten when refreshing the SDN.
Are the following Vnet configurations correct ?
Bash:
/etc/pve/sdn/subnets.cfg
subnet: internal-192.168.120.0-24
vnet dmzint
dnszoneprefix example.com
gateway 192.168.120.254
snat 1
subnet: external-192.0.2.0-24
vnet dmzext
gateway 192.0.2.254
/etc/pve/sdn/vnets.cfg
vnet: dmzint
zone internal
alias Vnet dmzint
isolate-ports 1
vnet: dmzext
zone external
alias External Vlan
/etc/pve/sdn/zones.cfg
simple: internal
dhcp dnsmasq
ipam pve
simple: external
ipam pve