[SOLVED] Passing 32+ VLANs to VM - what options?

bomzh

New Member
Mar 16, 2021
4
0
1
33
Greetings,

I know this has been asked many times, but I still did not find exact answer or solution. Using latest no-subscription PVE.

We need more than 32 VLANs passed to single VM. We were fine until we hit 32 virtual nics limit in VM configuration (I know there's an option to bump that number by editing one of Proxmox's libraries, but we're against this for obvious reasons) - so far we manage 32 VLANs by assigning vlan tag to each virtual NIC (32 so far). Each virtual NIC is using vmbr device on the hypervisor. I'm also aware that there's an option to use so-called "VLAN-aware bridge" and then just use a single virtual NIC within guest bound to that bridge and configure VLANs inside VM, however this raises important question in terms of security - since this single "VLAN-aware bridge" is used by many VMs, some of these VMs should not be able to access any VLANs, but only those configured for them inside Proxmox. To make it easier to understand here's what I mean:

0) "vmbr01" on Proxmox host is configured as VLAN-aware: 1-4096.
1) VM-A guest: single virtual NIC assigned to "vmbr01", then all required VLANs are configured inside the VM
2) VM-B guest: single virtual NIC assigned to "vmbr01", but this guest does not need to know or have access to other VLANs other than VID 100.

Can this be achieved? Perhaps I can simply add "tag=100" to "VM-B" guest inside Proxmox and this will be sufficient?

Thanks!
 

spirit

Famous Member
Apr 2, 2010
4,798
391
103
www.odiso.com
0) "vmbr01" on Proxmox host is configured as VLAN-aware: 1-4096.
1) VM-A guest: single virtual NIC assigned to "vmbr01", then all required VLANs are configured inside the VM
2) VM-B guest: single virtual NIC assigned to "vmbr01", but this guest does not need to know or have access to other VLANs other than VID 100.

Can this be achieved? Perhaps I can simply add "tag=100" to "VM-B" guest inside Proxmox and this will be sufficient?

yes, it' enough && secure.
vlan tag are done on virtual vmbrX ports, so they are no way to see others vlans if you have define a specific vlan on VM-B.

and if you want to restric the vlans list on VM-A, you can edit the vm configuration netX:...., and add ",trunks=20-30" for example. (it's not available yet in gui)
 
  • Like
Reactions: bomzh

bomzh

New Member
Mar 16, 2021
4
0
1
33
Hi

Thanks for your response and confirming this setup! We're going to implement this on our new network to see how it goes.

regards,
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE and Proxmox Mail Gateway. We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get your own in 60 seconds.

Buy now!