[TUTORIAL] HOWTO - Proxmox VE 8-x.x Wifi with routed configuration

ok i managed to install traceroute on the first vm and here's what happens when i traceroute 8.8.8.8:
Code:
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  _gateway (192.168.3.1)  0.293 ms  0.264 ms  0.257 ms
 2  192.168.1.1 (192.168.1.1)  2.248 ms  2.717 ms  2.947 ms
 3  151.7.206.36 (151.7.206.36)  12.447 ms  12.516 ms  12.826 ms
 4  151.7.51.168 (151.7.51.168)  12.429 ms  12.423 ms  12.943 ms
 5  151.6.1.168 (151.6.1.168)  13.780 ms  13.775 ms 151.6.3.180 (151.6.3.180)  14.432 ms
 6  151.6.7.181 (151.6.7.181)  13.677 ms 151.6.7.239 (151.6.7.239)  13.608 ms  13.904 ms
 7  74.125.32.80 (74.125.32.80)  13.986 ms  13.390 ms  15.355 ms
 8  * * *
 9  8.8.8.8 (8.8.8.8)  10.239 ms  10.442 ms  9.955 ms
 
ok i managed to install traceroute on the first vm and here's what happens when i traceroute 8.8.8.8:
Code:
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  _gateway (192.168.3.1)  0.293 ms  0.264 ms  0.257 ms
 2  192.168.1.1 (192.168.1.1)  2.248 ms  2.717 ms  2.947 ms
 3  151.7.206.36 (151.7.206.36)  12.447 ms  12.516 ms  12.826 ms
 4  151.7.51.168 (151.7.51.168)  12.429 ms  12.423 ms  12.943 ms
 5  151.6.1.168 (151.6.1.168)  13.780 ms  13.775 ms 151.6.3.180 (151.6.3.180)  14.432 ms
 6  151.6.7.181 (151.6.7.181)  13.677 ms 151.6.7.239 (151.6.7.239)  13.608 ms  13.904 ms
 7  74.125.32.80 (74.125.32.80)  13.986 ms  13.390 ms  15.355 ms
 8  * * *
 9  8.8.8.8 (8.8.8.8)  10.239 ms  10.442 ms  9.955 ms

The traceroute output you reported indicates the networking configuration is set up properly and your VM can reach the internet. If you want to route to hosts on the 192.168.3.0 network from hosts on the 192.168.1.0 network you will need to add static routes on hosts that reside on the 192.168.1.0 network. I included instructions in my post on how to add static routes for MacOS, and links to instructions for WIndows and Linux. The instructions are at the end of the first post.
 
ok but there's still a problem: i can ping ip addresses fine but i can't apt update or ping any domain
Code:
$ ping google.com
ping: google.com: Temporary failure in name resolution

$ ping youtube.com
ping: youtube.com: Temporary failure in name resolution
 
What does the command dig @1.1.1.1 google.com show? If it resolves properly then all you need to do is properly configure your VM to point to a valid DNS server for name resolution. You can use 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) for DNS servers.
 
it seems to be working
Code:
$ dig @1.1.1.1 google.com

; <<>> DiG 9.18.12-0ubuntu0.22.04.2-Ubuntu <<>> @1.1.1.1 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26635
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             215     IN      A       142.251.209.14

;; Query time: 4 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Wed Jul 03 05:35:09 UTC 2024
;; MSG SIZE  rcvd: 44
 
it seems to be working
Code:
$ dig @1.1.1.1 google.com

; <<>> DiG 9.18.12-0ubuntu0.22.04.2-Ubuntu <<>> @1.1.1.1 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26635
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             215     IN      A       142.251.209.14

;; Query time: 4 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Wed Jul 03 05:35:09 UTC 2024
;; MSG SIZE  rcvd: 44

The Wifi configuration with routed configured is working 100% as expected and is fully functional. Your problem now is that your VM is not properly configured for DNS resolution.

https://www.pdq.com/blog/change-dns-server-settings-in-windows/

https://www.tecmint.com/set-permanent-dns-nameservers-in-ubuntu-debian/

https://www.cyberciti.biz/faq/change-dns-ip-address-rhel-redhat-linux/

https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac

You can use 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) for DNS servers.
 
Last edited:
The Wifi configuration with routed configured is working 100% as expected and is fully functional. Your problem now is that your VM is not properly configured for DNS resolution.

https://www.pdq.com/blog/change-dns-server-settings-in-windows/

https://www.tecmint.com/set-permanent-dns-nameservers-in-ubuntu-debian/

https://www.cyberciti.biz/faq/change-dns-ip-address-rhel-redhat-linux/

https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac

You can use 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) for DNS servers.
it works perfectly now, thank you
 
I recently discovered there was a typo in the /etc/network/interfaces config posted in step 14. At some point spellcheck kicked in and changed 'o' to '0' by mistake for the FORWARD -o rules. The error has no effect on functionality as far as I can tell. Here is the proper config since I can't edit my original post.

Code:
auto lo
iface lo inet loopback

iface enp1s0 inet manual

auto wlp4s0
iface wlp4s0 inet manual
               address 192.168.1.100/24
               gateway 192.168.1.1

auto vmbr0
iface vmbr0 inet static
               address 192.168.2.1/24
               bridge-ports none
               bridge-stp off
               bridge-fd 0

auto vnet1
iface vnet1 inet static
               address 192.168.3.1/24
               bridge-ports none
               bridge-stp off
               bridge-fd 0
               hwaddress f6:c7:43:09:0b:45
               post-up echo 1 > /proc/sys/net/ipv4/ip_forward
               post-up iptables -A FORWARD -i wlp4s0 -j ACCEPT
               post-up iptables -A FORWARD -o wlp4s0 -j ACCEPT
               post-up iptables -A FORWARD -i vnet1 -j ACCEPT
               post-up iptables -A FORWARD -o vnet1 -j ACCEPT


source /etc/network/interfaces.d/*
 
@jeenam Thanks for the detailed writeup. When I have wired network, essentially I am able to access wlan interface remotely. Once i pull out ethernet cable, my wlan access gone. Not sure if I cannot have both wired and wifi configuration together. My intention is to use wifi as backup incase my cable connection gone for any reasons. Kindly need all your advise to achieve my needs.

- Unable to ping to 192.168.50.7 (ethernet cable pulled out)
- With monitor, keyboard connected, able to ping to outside network (e.g. google.com). I set the dns as 8.8.8. Able to traceroute, dig & no issues.
- Since 192.168.50.* cannot access, I doubt I can access 192.168.1.* (LXC)

*Managed to make it work but it does not fit my needs as I need to remove the vmbr0*

auto eth0
iface eth0 inet manual

auto vmbr0
iface vmbr0 inet static
address 192.168.50.6/24
gateway 192.168.50.2
bridge-ports eth0
bridge-stp off
bridge-fd 0


auto wlan0
iface wlan0 inet manual
address 192.168.50.7/24
gateway 192.168.50.2

auto vnet1
iface vnet1 inet static
address 192.168.1.1/24
bridge-ports none
bridge-stp off
bridge-fd 0
hwaddress f6:c7:43:09:0b:45
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -A FORWARD -i wlan0 -j ACCEPT
post-up iptables -A FORWARD -o wlan0 -j ACCEPT
post-up iptables -A FORWARD -i vnet1 -j ACCEPT
post-up iptables -A FORWARD -o vnet1 -j ACCEPT

wpa_supplicant : Configured same as others in this thread.

Static route (LAN) : configured as (192.168.1.0, 255.255.255.0, 192.168.50.7)

Added this route as well on my windows pc to access proxmox web UI and SSH..

Persistent Routes:
Network Address Netmask Gateway Address Metric
192.168.1.0 255.255.255.0 192.168.50.7 1
 
Last edited:
@jeenam Thanks for the detailed writeup. When I have wired network, essentially I am able to access wlan interface remotely. Once i pull out ethernet cable, my wlan access gone. Not sure if I cannot have both wired and wifi configuration together. My intention is to use wifi as backup incase my cable connection gone for any reasons. Kindly need all your advise to achieve my needs.

- Unable to ping to 192.168.50.7 (ethernet cable pulled out)
- With monitor, keyboard connected, able to ping to outside network (e.g. google.com). I set the dns as 8.8.8. Able to traceroute, dig & no issues.
- Since 192.168.50.* cannot access, I doubt I can access 192.168.1.* (LXC)

*Managed to make it work but it does not fit my needs as I need to remove the vmbr0*

auto eth0
iface eth0 inet manual

auto vmbr0
iface vmbr0 inet static
address 192.168.50.6/24
gateway 192.168.50.2
bridge-ports eth0
bridge-stp off
bridge-fd 0


auto wlan0
iface wlan0 inet manual
address 192.168.50.7/24
gateway 192.168.50.2

auto vnet1
iface vnet1 inet static
address 192.168.1.1/24
bridge-ports none
bridge-stp off
bridge-fd 0
hwaddress f6:c7:43:09:0b:45
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -A FORWARD -i wlan0 -j ACCEPT
post-up iptables -A FORWARD -o wlan0 -j ACCEPT
post-up iptables -A FORWARD -i vnet1 -j ACCEPT
post-up iptables -A FORWARD -o vnet1 -j ACCEPT

wpa_supplicant : Configured same as others in this thread.

Static route (LAN) : configured as (192.168.1.0, 255.255.255.0, 192.168.50.7)

Added this route as well on my windows pc to access proxmox web UI and SSH..

Persistent Routes:
Network Address Netmask Gateway Address Metric
192.168.1.0 255.255.255.0 192.168.50.7 1

https://unix.stackexchange.com/ques...ple-default-gateways-for-outbound-connections

https://serverfault.com/questions/823058/how-to-set-up-two-default-routes-in-linux
 
Managed to setup using Linux bond and achieve my needs. Again big thanks for these posts to allow me to explore and find a solution.

Found 1 issue. May require some assistance. Thanks.
WIFI & Ethernet - bonded (bond0 active-backup)
Linux bridge bond0 [192.168.xx.6]

Container (Debian) - Work no issues
Upon ethernet cable pulled out [Host accessible]

Issue
- Container CT 192.168.xx.5 [managed to make it accessible to internet with iptable rule on host]
-A POSTROUTING -s 192.168.xx.5/32 ! -d 192.168.xx.6/32 -o vmbr0 -j SNAT --to-source 192.168.50.6
- Local PC on the same network unable to ping & not able to SSH to CT [CT & host can able to ssh/ping each other]
- I need to access media server (e.g. jellyfin, emby) on CT installed via docker.

I assume that I am missing some rule to be set to open the access to other PC(s), device in the same network.

Just one note, when I tried to use 192.168.xx.6 for bond0 and different subnet 192.168.yy.1 for bridge & define FORWARD or SNAT rule with SDN or normal VMBR0 bridge, everything works as expected.
 
Last edited:
Managed to setup using Linux bond and achieve my needs. Again big thanks for these posts to allow me to explore and find a solution.
Found 1 issue. May require some assistance. Thanks.
WIFI & Ethernet - bonded (bond0 active-backup)
Linux bridge bond0 [192.168.xx.6]

Container (Debian) - Work no issues
Upon ethernet cable pulled out [Host accessible]

Issue
- Container CT 192.168.xx.5 [managed to make it accessible to internet with iptable rule on host]
-A POSTROUTING -s 192.168.xx.5/32 ! -d 192.168.xx.6/32 -o vmbr0 -j SNAT --to-source 192.168.50.6
- Local PC on the same network unable to ping & not able to SSH to CT [CT & host can able to ssh/ping each other]
- I need to access media server (e.g. jellyfin, emby) on CT installed via docker.

I assume that I am missing some rule to be set to open the access to other PC(s), device in the same network.

Just one note, when I tried to use 192.168.xx.6 for bond0 and different subnet 192.168.yy.1 for bridge & define FORWARD or SNAT rule with SDN or normal VMBR0 bridge, everything works as expected.
 
I'm a bit unclear on how the container is configured from a network perspective. If the container is SNAT'd that means it is on a different subnet than the other hosts on your network and the Proxmox host is doing the NAT. If you want to reach hosts behind a NAT you need to set explicit iptables DNAT rules to route traffic to hosts behind the NAT for any hosts that are on the other side of NAT.

http://linux-ip.net/html/nat-dnat.html
 
I'm a bit unclear on how the container is configured from a network perspective. If the container is SNAT'd that means it is on a different subnet than the other hosts on your network and the Proxmox host is doing the NAT. If you want to reach hosts behind a NAT you need to set explicit iptables DNAT rules to route traffic to hosts behind the NAT for any hosts that are on the other side of NAT.

http://linux-ip.net/html/nat-dnat.html
As I mentioned, when created under different subnet (Host & LXC CT), everything works well (redundancy b/w WIFI & wired connection). Just because of WIFI, I required to create the SNAT rule to allow container (CT) to able to access internet.
So, based on your suggestion, if DNAT is ony option which I tried before, that means in the local network, I shall not directly access 192.168.xx.5 & should use 192.168.xx.6 only is it?
- Example if I need to setup Homepage docker container (port 3000) setup on 192.168.xx.5, then from the browser, I shall access to the page using http://192.168.xx.6:3000 instead of http://192.168.xx.5:3000

iptables -t nat -A PREROUTING -d 192.168.xx.5 -j DNAT --to-destination 192.168.xx.6

In this case, if I need to access PVE (192.168.xx.6) webui on port 8006, will also be reidrected to 192.168.xx.5. right? so I likely need to exclude certain ports like ssh, web ui etc. Not sure if I am trying to make sense :)
 
As I mentioned, when created under different subnet (Host & LXC CT), everything works well (redundancy b/w WIFI & wired connection). Just because of WIFI, I required to create the SNAT rule to allow container (CT) to able to access internet.
So, based on your suggestion, if DNAT is ony option which I tried before, that means in the local network, I shall not directly access 192.168.xx.5 & should use 192.168.xx.6 only is it?
- Example if I need to setup Homepage docker container (port 3000) setup on 192.168.xx.5, then from the browser, I shall access to the page using http://192.168.xx.6:3000 instead of http://192.168.xx.5:3000

iptables -t nat -A PREROUTING -d 192.168.xx.5 -j DNAT --to-destination 192.168.xx.6

In this case, if I need to access PVE (192.168.xx.6) webui on port 8006, will also be reidrected to 192.168.xx.5. right? so I likely need to exclude certain ports like ssh, web ui etc. Not sure if I am trying to make sense :)

You can, and should, explicitly specify which ports should be destination NAT'd to hosts behind the NAT. Use --dport.

Example:

iptables -t nat -A PREROUTING -p tcp -i <interface> --dport 8001 -j DNAT --to-destination 192.168.1.200:8080

Also, I'm unclear why you decided to use NAT for the container. If it is a proxmox hosted container you can assign it to the same local network as the rest of your hosts using SDN VNET. That's the whole point of using the routed configuration - to avoid having to perform any NAT'ing and thus not having to use iptables rules to DNAT. Also, DNAT doesn't play nice with some services. That's the reason I did this write-up for a routed configuration. My first write-up was WiFi with NAT, which I no longer use because of the exact issue you're trying to solve for.
 
Last edited:
You can, and should, explicitly specify which ports should be destination NAT'd to hosts behind the NAT. Use --dport.

Example:

iptables -t nat -A PREROUTING -p tcp -i <interface> --dport 8001 -j DNAT --to-destination 192.168.1.200:8080

Also, I'm unclear why you decided to use NAT for the container. If it is a proxmox hosted container you can assign it to the same local network as the rest of your hosts using SDN VNET. That's the whole point of using the routed configuration - to avoid having to perform any NAT'ing and thus not having to use iptables rules to DNAT. Also, DNAT doesn't play nice with some services. That's the reason I did this write-up for a routed configuration. My first write-up was WiFi with NAT, which I no longer use because of the exact issue you're trying to solve for.
Code:
#Default settings for loopback
auto lo
iface lo inet loopback

#Slaves must each have identical bond settings
#Slaves must be set to auto and appear before the bond in this file
auto eth0
iface eth0 inet manual
        bond-master bond0
        bond-primary eth0
        bond-mode active-backup

auto wlan0
iface wlan0 inet manual
        bond-master bond0
        bond-primary eth0
        bond-mode active-backup

auto bond0
iface bond0 inet manual
        bond-slaves eth0 wlan0
        bond-primary eth0
        bond-mode active-backup
        bond-miimon 100
        bond-downdelay 0
        bond-updelay 0

auto vmbr0
iface vmbr0 inet static
        address 192.168.xx.6/24
        gateway 192.168.xx.2
        bridge_ports bond0
        bridge_stp off
        bridge_fd 0

        post-up iptables -t nat -A POSTROUTING -o vmbr0 -s 192.168.xx.5/32 ! -d 192.168.xx.6/32 -j SNAT --to-source 192.168.xx.6
        post-down iptables -t nat -D POSTROUTING -o vmbr0 -s 192.168.xx.5/32 ! -d 192.168.xx.6/32 -j SNAT --to-source 192.168.xx.6

This is my configuration. Your configuration created vnet on different subnet. I am trying to maintain the same subnet as home router network (192.168.xx.1). With this configuration, I don't think I can use FORWARD ACCEPT to make it work as in your configuration w/o SNAT.
My LXC able to get an IP (192.168.xx.5 with gateway using host IP 192.168.xx.6). Only issue I have is that I am unable to access LXC IP from another local PC on 192.168.xx.8. Actually, cannnot ping to & fro LXC and even SSH.

Yes, I am aware of the fact of DNAT (even multiple ports) but essentially it all means that I cannot directly access LXC container & required to route through host. Issue is that when wired (eth0), LXC accessible. The moment, I pull out the cable, LXC not accessible.

My hunch is that with wifi setup, we shall not be able to use same subnet b/w host & LXC unless add more tweaks other that SNAT mentioned above.

This is my another working configuration but with LXC/VM subnet different from home network subnet. With this setup, I am able to use with & without SNAT.

Code:
cat interfaces.d/sdn
#version:32

auto vnet1
iface vnet1
        address 192.168.1.1/24
        bridge_ports none
        bridge_stp off
        bridge_fd 0
        ip-forward on

cat interfaces

#Default settings for loopback
auto lo
iface lo inet loopback

auto bond0
iface bond0 inet static
        bond-slaves eth0 wlan0
        address 192.168.xx.6/24
        gateway 192.168.xx.2
        bond-primary eth0
        bond-mode active-backup
        bond-miimon 100
        bond-downdelay 0
        bond-updelay 0

#Slaves must each have identical bond settings
#Slaves must be set to auto and appear before the bond in this file
auto eth0
iface eth0 inet manual
        bond-master bond0
        bond-primary eth0
        bond-mode active-backup

auto wlan0
iface wlan0 inet manual
        bond-master bond0
        bond-primary eth0
        bond-mode active-backup

        post-up iptables -t nat -A POSTROUTING -s '192.168.1.0/24' -o bond0 -j SNAT --to-source 192.168.xx.6
        post-down iptables -t nat -D POSTROUTING -s '192.168.1.0/24' -o bond0 -j SNAT --to-source 192.168.xx.6


Code:
=============================================================
Without SNAT (also working) but also different subnet from home network subnet
====================================================================
auto vnet1
iface vnet1 inet static
        address 192.168.1.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -D FORWARD -i bond0 -j ACCEPT
post-up iptables -D FORWARD -o bond0 -j ACCEPT
post-up iptables -D FORWARD -i vnet1 -j ACCEPT
post-up iptables -D FORWARD -o vnet1 -j ACCEPT
post-up iptables -A FORWARD -i bond0 -j ACCEPT
post-up iptables -A FORWARD -o bond0 -j ACCEPT
post-up iptables -A FORWARD -i vnet1 -j ACCEPT
post-up iptables -A FORWARD -o vnet1 -j ACCEPT
 
Last edited:
My hunch is that with wifi setup, we shall not be able to use same subnet b/w host & LXC unless add more tweaks other that SNAT mentioned above.

Someone with greater expertise with networking will have to chime in here, but I suspect the problem is occurring at the Layer 2 MAC address layer. Network devices send out an ARP advertisements to notify which physical path they can be reached at. The interval for ARP advertisements varies but is usually less than 30 minutes. When your Proxmox host is connected via ethernet the switch that it is connected to stores the MAC Address to IP Address mapping in it's local lookup table. Obviously the VM's use that same physical link so the switch will again, store the MAC to IP mapping for the VM so it knows which physical port on the switch to transfer packets to reach the host. When you pull the ethernet cable, the Proxmox host's bond[N] will transmit the appropriate Layer 2 messages to network devices so that it can still be reached via the updated physical network path. Since the VM's/containers on the Proxmox host have zero knowledge of the bond0 link failing over, they do not send ARP advertisements to update the physical path by which they can be reached.

That's my guess.
 
I skipped the iptables part and it still works :eek:
Is it normal?

interfaces file:

Code:
auto lo
iface lo inet loopback

iface enp0s31f6 inet manual

auto vmbr0
iface vmbr0 inet static
        address 192.168.4.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0

iface enp2s0 inet manual

auto wlp0s20f3
iface wlp0s20f3 inet manual
        address 192.168.2.10/24
        gateway 192.168.2.1

auto vnet1
iface vnet1 inet static
               address 192.168.3.1/24
               bridge-ports none
               bridge-stp off
               bridge-fd 0
               hwaddress f6:c7:43:09:0b:45

iptables:
Code:
iptables -L -v -n
Chain INPUT (policy ACCEPT 4250 packets, 1755K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 466 packets, 154K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 3528 packets, 2707K bytes)
 pkts bytes target     prot opt in     out     source               destination

vm is running on 192.168.3.10 and it has internet acccess.
I can also access it via web on 9443 (portainer)
 
Or it could just be that wifi doesn't work with bridging so when it fails over it stops working.

Correct. Not sure if they realize that though.

You cannot bridge a wireless adapter unless the Wifi router supports WDS mode. The Proxmox wiki is very clear about this. It's why I wrote up the tutorial in the first place - because normally you cannot bridge a wireless adapter.

https://pve.proxmox.com/wiki/WLAN
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!