Private Networks best practice question

[mokaz]

Hi there all,

I'm currently setting up a PVE node behind an ISP uplink. That node has a single physical Ethernet interface.
I will need many backend "Private Networks" to host VMs and internal networking's etc.

My question is the following; I've seen advice to use "dummy interfaces" like this:

auto dummy999
iface dummy999 inet manual
        link-type dummy
#NIC_999_DUMMY

auto vmbr999
iface vmbr999 inet manual
        bridge-ports dummy999
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 2-4094
#BRI_DUMMY

And of course add Linux VLANs within the above mentioned vmbr999 (like vmbr999.222 etc etc etc)

Or simply through a bridge with no port bound:

auto vmbr1
iface vmbr1 inet manual
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 2-4094
#BRI_PRIV_1

Are there any advantage/disadvantage of using one or the other ?

Thanks,
Kind regards,
M.

 

[aaron]

If you need internal networks just on the node itself, you can define a vmbr interface and leave the bridge port empty. No need for a dummy device.

If the VMs need to be part of some VLAN in your physical network, you have a few options.

One is to just assign them the vmbr on the physical network, most likely vmbr0, and then assign the VLAN tag in the VMs network interface.
You could create a new vmbr for that VLAN and use the dot notation in the bridge port to define the vlan, or you make the vmbr vlan-aware and set the vlan tags inside the VM.

 

[mokaz]

Hi Aaron, thanks a lot for your update.

Basically, the idea is to host a NGFW VM that will take care of the backend traffic policies etc, all on virtual networks, vlans etc.
That same VM will terminate tunneling connectivity from the WAN front end, indeed, vmbr0.

I'll go with the unbound vmbr option, which seems to make most sense.
Still though, in what scenarios would a "dummy" interface make sense ?

Cheers,
m.

 

[aaron]

Okay, so if I understand you correctly, you have something like:

WAN --- (untagged VLAN ID) --> Switch --- (tagged) -----> PVE?

In that case I would configure the Switch port on which the Modem is on, as an untagged VLAN (the modem has no idea it is in a VLAN) so it is separated in its own VLAN.

Still though, in what scenarios would a "dummy" interface make sense ?

No idea... a Linux Bridge (vmbr) works without any bridge port just fine.

 

[mokaz]

Hi Aaron,

Well more something like this:

WAN -----> (untagged) -----> PVE -----> NGFW VM -----> (tagged traffic towards many many potential VLANs/destinations/hosts/segmented virtual networks)

I'll post my further findings here.
Thanks again for your time.

Kind regards,
m.