Make individual NICs only accessible to VMs without PCI passthrough

[rokyo401]

Hi there,

I'm currently setting up a server as a Proxmox host which is supposed to hold two VMs (for now):
- one Debian 12 instance as a remote desktop server with ThinLinc
- one Debian 12 instance as a compute node for HTcondor

The host machine has 4 onboard 1GB network ports and a 10GB Intel NIC with two ports as a PCIe card.

My plan is to have:
- two of the 1GB ports in a bond, going into our internal switch for the management network and the virtual network between the two VMs (IP range 192.168.0.0/24)
- the other two 1GB ports in a bond, going into our DMZ switch for external access to the ThinLinc server (IP range 192.168.10.0/24)
- the two 10GB ports in a bond, going into our internal storage network on an isolated switch (IP range 10.0.10.0/24)

The 10GB bond and the internal 1GB bond should be accessible by both VMs and the host. The external (DMZ) 1GB bond should absolutely not allow any access to the host or condor VM but ONLY to the ThinLinc VM. Is there any way to configure it this way without passthrough'ing the two 1GB ports to this VM?

I don't want to use passthrough because of the complete allocation of the VMs RAM into the host RAM, as I learned here (https://forum.proxmox.com/threads/pcie-passthrough-breaks-display-of-memory-usage.142444/) and here (https://forum.proxmox.com/threads/very-high-memory-usage-on-vm.140907/), since both VMs together will have >90% of the host's RAM allocated in total and I believe there will be severe issues if >80% of host RAM is constantly allocated, if I understood right.

Thanks in advance for any advice!

 

[gurubert]

You will have three bridge interfaces (vmbr0, vmbr1 and vmbr2).
Your Proxmox host will only need an IP address on the bridges for the management network and the storage network.
The unnumbered bridge will pass through the Ethernet frames only to the VM that is connected to it.

 

[rokyo401]

Oh, so there is no need at all for PCI passthrough in order to isolate network traffic from the Proxmox host? That's great! Then I can avoid the passthrough altogether!

 

[gurubert]

The traffic will still pass through the bridge code of the Proxmox's Linux kernel.
But AFAIK there is no way for a network packet to break free from there.

 

[rokyo401]

That's good, as long as my Proxmox host will not be made available in the DMZ (or be attacked from there, for example by DDoS), it is all perfect

 

[gurubert]

A DDoS could also have implications on the Proxmox host as the kernel has to handle all the packets.
But I would assume that under a DDoS the data line from the Internet to your Proxmox node is the first thing affected.

 

[rokyo401]

I did it now with a bond -> vmbr on the Proxmox host which is then passed to the VM and gets an IP only inside the VM. This seems to work more or less, but I already opened a new issue for the resulting problem. I don't think that problem comes from not passing through the NIC, so a new issue seemed reasonable ;-)