Safe vlan setup and management

M

mva

Renowned Member
Dec 9, 2008
33
0
71
Hi,

I have a plan of unifying the management of 4 separate PVE environments. Each server has a dual port nic so would it be a "safe" setup to configure those boxes so that the other physical nic is reserved only for management traffic (ssh & https access to host environment & external backups) and the other interface handles all VM traffic?

To be more specific:

  • Each management nic (eth0) is connected to vmbr0 and has an IP address assigned. This should be the only route to the host.
  • The other nic (eth1) is configured with X vlan interfaces (eth1.1, eth1.2 etc) and each vlan is connected to a bridge of its own respectively. None of the vlan interfaces or bridges has an IP address. Each bridge has N VEs (with IPs and mac) connected.
  • Each host has iptables rules set to drop all traffic between eth1.X and eth0 and between bridges. This may not even be necessary?
I want each of the vlans to be completely layer2 & 3 isolated from each other and from the management lan. Does this kind of setup lead me to the goal? I am reasoning that at least no ip traffic should be routable between the bridges within server, but are there some layer2 pitfalls that I'm not aware of?

I know that to be 100% sure I should separate "sensitive" vlans to different physical servers and allow management only via console, but that kind of arrangement is an impractical overkill right now.

- Mikael
 
What about OpenVZ containers with venet-networking? Those require the host node to have a routable IP address. So if I still want to accomplish complete isolation between management and other vlans I should switch venet interfaces to veth. But if routing of venet traffic is fine I should protect that host interface with iptables and drop all input/output traffic. Am I right?

And one more question. If I change to clusterized setup, does it have any networking related special requirements? Am I able to manage hosts and migrate VEs through management lan (same IP subnet) ?
 
mva said:
But if routing of venet traffic is fine I should protect that host interface with iptables and drop all input/output traffic. Am I right?
Click to expand...

yes, you need iptable to protect the host.

mva said:
And one more question. If I change to clusterized setup, does it have any networking related special requirements? Am I able to manage hosts and migrate VEs through management lan (same IP subnet) ?
Click to expand...

Yes. But I suggest that you test such setup first.
 
You must log in or register to reply here.
Top Bottom