Passing VLANs as a Secondary Network Interface to VMs

cauliflower

New Member
Feb 18, 2025
1
0
1
Hi,

I'm having an issue with passing two network interfaces to VMs. The idea is that I want one network interface for all untagged traffic, and one interface for tagged traffic. The PVE host itself is using these VLANs fine (I use the tagged traffic for NFS), however, I can't seem to be able to access the tagged VLAN from within any VMs. Here is my config:

Code:
auto lo
iface lo inet loopback

auto enp1s0f0
iface enp1s0f0 inet manual

auto enp1s0f1
iface enp1s0f1 inet manual

auto bond0
iface bond0 inet manual
    bond-slaves enp1s0f0 enp1s0f1
    bond-miimon 100
    bond-mode 802.3ad

auto vmbr0
iface vmbr0 inet manual
    bridge-ports bond0
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 2-8

auto vmbr0.1
iface vmbr0.1 inet static
    address 192.168.1.20/24
    gateway 192.168.1.1

auto vlanNFS
iface vlanNFS inet static
    address 192.168.2.20/24
    vlan-id 8
    vlan-raw-device bond0

This allows the PVE host to ping traffic both on the 192.168.1.20/24 and the 192.168.2.20/24 network without issue.

On my VM, I have two network devices configured, both connected to the vmbr0 bridge, one with no VLAN tag and one with a VLAN tag of 8.

In the VM itself, I have the following config:
Code:
# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto ens18
allow-hotplug ens18
iface ens18 inet static
  address 192.168.1.21
  gateway 192.168.1.1
  netmask 255.255.255.0

auto ens19
iface ens19 inet static
  address 192.168.2.21/24

It appears that the correct routes are in the route table:
192.168.1.0/24 dev ens18 proto kernel scope link src 192.168.1.21
192.168.2.0/24 dev ens19 proto kernel scope link src 192.168.2.21

However, I'm not able to ping or access anything on the 192.168.2.0/24 subnet that I am able to reach from the host. Any ideas?