Proxmox VLAN segmentation

[Nautixl]

Hi everyone, have alread read and watched a few guides but it still didnt click with me on how to aproach my goal. Hopefully someone can shed some light on my situation.
I am planning to segment my home lab to improve security but there are so many ways I got overhelmed.

What I want to achieve:
Create a barrier between the Proxmox Management network and the VM network, while maintaining SSH access from my main Desktop to all VMs.
Hardware Available:
Router: Fritzbox 7530
Switch: Smart Managed (VLAN capable) L2 Switch
Proxmox Host: Lenovo mini-PC (1 physical NIC)
Desktop (daily driver): Windows 10 (1 physical NIC)
Hard Constraints:
1. All LAN devices must have access to the VMs due to my planned jellyfin, paperless, etc. stuff.
2. Internet access for the house must not be reliant on Proxmox uptime
3. Only my Windows Desktop should have access to the Proxmox Management UI

At first, I frickled with VLAns until I realized that OPNsense would be before everything this making it unviable as an option as I dont want to rely on a virtualized firewall completely.
I then considered just using the VE firewall and dropping everything except packets from my desktop but this seems rather light as a barrier and also doesnt solve my OPNsense issue.

Additionally i got pretty confused regarding vlan and bridges in proxmox.
For now, I just created two interfaces on the opnsense VM utilizing vmbr0 and plan to map vnet0 to one and vnet1 to the other (WAN & LAN) but i am not sure how safe this is.


Future Considerations:
I plan to set up a virtualized OPNsense instance and an Nginx reverse proxy to expose services like Immich and Nextcloud publicly via DynDNS and port forwarding.

Sorry if the post is chaotic, I tried my best to be clear but my head is smoking from all the networking shenanigans.

 

[d.oishi]

For now, I just created two interfaces on the OPNsense VM using vmbr0 and plan to map one to WAN and the other to LAN, but I am not sure how safe this is.

A Proxmox bridge acts like a virtual Layer 2 switch, so using the same vmbr0 is not inherently unsafe by itself. The real question is whether WAN and LAN are actually separated at Layer 2. If both OPNsense interfaces are connected to the same bridge on the same untagged segment, or effectively the same VLAN, then WAN/LAN separation is weak. If they are placed on different VLANs, then the separation is meaningful even when the same vmbr0 is used. Proxmox supports assigning a VLAN tag per guest NIC on a VLAN-aware Linux bridge.

My understanding is that the cleaner approach is the following:

• separate the existing home network
• a Proxmox management network
• and a server / VM network
• The link between the managed switch and Proxmox should be a trunk.

The link between the router and the managed switch only needs to be a trunk if the router can terminate and route multiple 802.1Q VLANs over a single physical link. If the router can instead provide separate routed interfaces for each network, then that link does not need to be a trunk.

On the Proxmox side, I would use a VLAN-aware bridge, put the host management IP on something like vmbr0.20, and attach VMs to vmbr0 while setting the required VLAN tag per NIC. Inter-VLAN communication would then be handled by the router/firewall that terminates those VLANs.
https://pve.proxmox.com/wiki/Network_Configuration#sysadmin_network_vlan

For example, if:

• VLAN 10 = existing home network / upstream
• VLAN 20 = Proxmox management
• VLAN 30 = server / VM network

then /etc/network/interfaces could look like this:

auto lo
iface lo inet loopback

iface eno1 inet manual

auto vmbr0.20
iface vmbr0.20 inet static
    address 192.168.20.10/24
    gateway 192.168.20.1

auto vmbr0
iface vmbr0 inet manual
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 2-4094

The link between the managed switch and Proxmox should be a trunk.
The link between the router and the managed switch only needs to be a trunk if the router can terminate and route multiple 802.1Q VLANs over a single physical link. If the router can instead provide separate routed interfaces for each network, then that link does not need to be a trunk.

Only my Windows Desktop should have access to the Proxmox Management UI

I think this can be done through /etc/default/pveproxy.

https://pve.proxmox.com/pve-docs/pveproxy.8.html
Host based Access Control