Regarding subnetting/VLANs wthin Proxmox/pfSense

[synk2]

Hi there. I've been using Proxmox 3.4 for a couple months now and very much enjoying it. In an attempt to expand my options, I've been looking into adding subnetting and VLANs. This has led to some questions that I'm hoping someone here might be able to answer.

Current setup (single box, 3 GbE ports):
vmbr0: eth0 - management
vmbr1: eth1 - passed to pfSense for WAN
vmbr2: eth2 - passed to pfSense for LAN
vmbr3: internal, currently for a Windows 2012 network

I'm running pfSense as a KVM within Proxmox, and it's working great for my current basic setup.

What I'd like to achieve:
I'd like to set up some subnets separate from my home production network. I'd need them isolated from my normal (192.168.0.0) network, as I'd like to be able to play around with some Windows Server DHCP/routing options without affecting the rest of my home network. This would be all internal to Proxmox - it'd never need to route out to the physical switch. However I would like to be able to have internet passed through to that subnet via pfSense.

My understanding is the VLANs would be a good way to achieve this. I've read through the Networking/VLAN/VLANs documentation, and attempted some of the configurations there. My issue that is I'm not seeing a way to keep this internal - all of the suggested configurations involve an eth and bonding. I've tried various combinations as suggested in the docs, but some of them just choked Proxmox at boot, some of them just threw errors. I did manage to set up a separate network on vmbr3 with a different subnet, but I couldn't find a way to get pfSense to pass internet to it as a gateway, as it doesn't like the gateway outside the subnet combination.

Is a bond required for a VLAN? Can you create a bond with only one NIC (I know it doesn't make much sense) for purposes of a VLAN? Am I going about this all wrong? Is what I'm attempting even possible? I'm in uncharted territory here as far as my networking experience and Proxmox. Any advice on how to go about this would be greatly appreciated.

 

[Phlogi]

Interesting question - you ever got advice?

 

[netweber]

I'd like to set up some subnets separate from my home production network. I'd need them isolated from my normal (192.168.0.0) network, as I'd like to be able to play around with some Windows Server DHCP/routing options without affecting the rest of my home network. This would be all internal to Proxmox - it'd never need to route out to the physical switch. However I would like to be able to have internet passed through to that subnet via pfSense.

For this I would create a new Linux bridge in Proxmox, you could use vmbridge1 if it is not in use already. You don't need VLAN's for this since you will not be passing this network out to your switch. VLAN's allow you to pass multiple networks between switches while using only a single link.

Once you have created your new bridge and rebooted Proxmox , you will need to add an additional interface on your PfSense VM that is linked to your newly created bridge. Then in PfSense you will need to go to "Interfaces" "Assign" and a new interface using your newly added NIC.

Finally , you will need to go to the Firewall Rules tab in PfSense and then go to your newly added interface. Within that interface's rules listing you will need to create a new rule to allow traffic from that interface out to the internet. If this is to be a DMZ network, then I would usually create a rule that blocks all traffic to my local networks, and then add a rule below it to pass all traffic from my new network to any.

Good Luck
Julian Weber