How to isolate virtual machines on the same bridge without affecting their communication with each other?

[hardship]

It’s like simulating two hosts that connect to an external firewall through separate network interfaces.
But I’ve found that this seemingly simple feature is actually quite difficult to implement on PVE.

I plan to route all traffic from the virtual machines through an external firewall for traffic analysis or other purposes. The vmbr0 bridge in PVE is connected to the LAN port of the external firewall.
Because the virtual machines are on the same bridge and in the same subnet, the bridge forwards traffic internally directly based on the known MAC addresses.
I tried：

• Isolating the ports or using an ebtables firewall will cause them to be unable to communicate with each other.
• Creating a separate bridge for each virtual machine and connecting it to the internal firewall VM is basically a crappy approach.
• The internal firewall in PVE is quite rudimentary, and traffic cannot be analyzed directly.

I’m not sure if OVS can implement this, and whether its port isolation option completely blocks communication between the VMs.
From my search, this seems to be the Private VLAN feature on ESXi, but it is rarely supported on Linux. Since my hardware isn’t compatible with ESXi, I have to continue using PVE.

 

[david_devops]

I have exactly the same problem.
I have three Kubernetes clusters.
All machines are in one subnet and bridged in Proxmox. I want the machines within each cluster to be able to communicate with each other, but the machines of different clusters should not be able to communicate with each other.
Essentially, I want to isolate the clusters.