Dear Proxmox Team,
when a bridge is selected (no SDN), the hint in the dropdown box "VLAN Tag" should be changed to "all VLAN":
Background:
One day I was debugging IPv6 address assignment issues and I noticed that VMs got IPv6 addresses from different VLANs assigned with SLAAC.
This puzzled me quite some time until I found out that I needed to specify a VLAN tag of 1 to stop that behaviour.
The key was written somewhere in the docs but I think many users are unaware that "no VLAN" means actually "pass all VLANs which are on the bridge".
To avoid this misunderstanding and to block an inherent security issue (unknowingly assigning multiple VLANs to a machine), something has to be changed.
A root user on a virtual machine would be able to access other VLANs just by adding tags....
At least I'd suggest to just rename the VLAN Tag hint in the dropdown list.
Maybe a warning could be shown to make the admin aware about this behaviour.
Thanks for your consideration.
Best regards,
Bernhard
when a bridge is selected (no SDN), the hint in the dropdown box "VLAN Tag" should be changed to "all VLAN":
Background:
One day I was debugging IPv6 address assignment issues and I noticed that VMs got IPv6 addresses from different VLANs assigned with SLAAC.
This puzzled me quite some time until I found out that I needed to specify a VLAN tag of 1 to stop that behaviour.
The key was written somewhere in the docs but I think many users are unaware that "no VLAN" means actually "pass all VLANs which are on the bridge".
To avoid this misunderstanding and to block an inherent security issue (unknowingly assigning multiple VLANs to a machine), something has to be changed.
A root user on a virtual machine would be able to access other VLANs just by adding tags....
At least I'd suggest to just rename the VLAN Tag hint in the dropdown list.
Maybe a warning could be shown to make the admin aware about this behaviour.
Thanks for your consideration.
Best regards,
Bernhard