Hi Everyone!
Very very very long time since I've written a real post on here, but it's nice to be back, and I even have a blog now, what do you know? Anyway, I'm deploying a new PVE environment on a flat layer 2 network with no VLAN ability. I've decided from past experiences under these constraints, that it's unbearable to have a DMZ tied to a vmbr on a single node and especially during maintenance having to move everything over to another node. Fortunately, most of my environments have adequate redundant L3 switches or stacks, and trunking is very straight forward. However, I am faced with a smaller environment for my next project and it has limited networking capabilities and the hypervisors will be in a strange zone that requires a bit more care...
I need to securely forward traffic at this site from the internet to a given guest. My idea was to deploy something like this:
Internet --> EVPN for hypervisors acting as gateways --> VXLAN for guests
It seems like if I give the hypervisor nodes each an underlay IP 10.0.0.10, .11, .12 and then go into the PVE Web Interface and create an EVPN controller: Datacentre > SDN > Options > Controllers > Add
I can then setup some parameters like so:
(this is from my Bookstack Wiki)
and then I can create the EVPN Zone via: Datacentre > SDN > Zones > Add > EVPN
I can then use the following:
I think the important objectives this satisfies are:
Oh and lastly, I expect to have one dual-homed guest, meaning it will have two vmbr interfaces, one on the underlay and one on an overlay. It will be a reverse proxy, because I do not wish to meddle with port forwarding through the SNAT...
Thanks!
Tmanok
Very very very long time since I've written a real post on here, but it's nice to be back, and I even have a blog now, what do you know? Anyway, I'm deploying a new PVE environment on a flat layer 2 network with no VLAN ability. I've decided from past experiences under these constraints, that it's unbearable to have a DMZ tied to a vmbr on a single node and especially during maintenance having to move everything over to another node. Fortunately, most of my environments have adequate redundant L3 switches or stacks, and trunking is very straight forward. However, I am faced with a smaller environment for my next project and it has limited networking capabilities and the hypervisors will be in a strange zone that requires a bit more care...
I need to securely forward traffic at this site from the internet to a given guest. My idea was to deploy something like this:
Internet --> EVPN for hypervisors acting as gateways --> VXLAN for guests
It seems like if I give the hypervisor nodes each an underlay IP 10.0.0.10, .11, .12 and then go into the PVE Web Interface and create an EVPN controller: Datacentre > SDN > Options > Controllers > Add
I can then setup some parameters like so:
| Field | Value |
|---|---|
| ID | evpnctl |
| ASN | 65000 |
| Peers | 10.0.0.10 |
| Nodes | pve1 |
| SDN Fabric | blank |
| BGP Mode | auto |
| Everything else | blank / default |
and then I can create the EVPN Zone via: Datacentre > SDN > Zones > Add > EVPN
I can then use the following:
| Field | Value |
|---|---|
| ID | overlay |
| Primary Controller | evpnctl |
| VRF-VXLAN Tag | 10000 |
| VNet MAC Address | auto |
| Exit Nodes | pve1 |
| Primary Exit Node | pve1 |
| Exit Nodes Local Routing | Enabled |
| Advertise Subnets | Disabled |
| Disable ARP-ND Suppression | Disabled |
| MTU | 1450 |
| Nodes | pve1 |
| IPAM | pve |
| DNS / Reverse DNS / DNS Zone | blank (I will use PowerDNS later) |
I think the important objectives this satisfies are:
- Hosts on the underlay can respond back to hosts on the overlay exiting their anycast gateway via the exit node;
- The basic ISP modem which does not understand routing won't receive random RA packets;
- MTU should be fine for any switch and the outbound internet traffic;
- Lastly, the PVE hosts will need to reach a PBS VM hosted within them on an overlay, which is the main reason I turned on "Exit Nodes Local Routing";
Please let me know if there are any caveats or benefits to this.
| DMZ | Services | |
|---|---|---|
| ID | dmz | services |
| Zone | overlay | overlay |
| Tag | 10010 | 10020 |
| Subnet | 10.0.1.0/24 | 10.0.2.0/24 |
| Gateway | 10.0.1.1 | 10.0.2.1 |
| SNAT | Enabled | Enabled |
| DNS Zone Prefix | dmz | services |
Oh and lastly, I expect to have one dual-homed guest, meaning it will have two vmbr interfaces, one on the underlay and one on an overlay. It will be a reverse proxy, because I do not wish to meddle with port forwarding through the SNAT...
Thanks!
Tmanok