Understanding networking - Question around keeping interfaces private.

[deanfourie]

Question regarding networking,

Is there a way to keep interfaces completely isolated from Proxmox? I have the physical interfaces and bridges setup in proxmox, but no IP address assigned, this that secure enough to ensure no traffic from that interface can reach my Proxmox server?

The physical interface is added to a bridge, then no IP addresses are allocated, I then add said bridge to required vms and then assign IPs within the VMs themselves.

Thanks

 

[Dunuin]

Some people virtualizing a router like to PCI passthrough a NIC for WAN into a VM. That way the NIC is directly used by the VM and not by the host.

But as long as the host doesn't got a IP on that NIC/Bridge, it shouldn't listen to any packets and just forward/route them. So the attack vector is quite limited.

 

[deanfourie]

This is exactly how I've done this for my pfSense vm. I have PCIE passthrough only for the WAN interface.