Understanding Vlan ant NIC managment

[m.nosarzewski]

Im pretty new to Proxmox and have some difficulties. My machine is reciving 5 Vlans via trunk port (im only reciving them so i can't change anything on this side)
One Vlan is for managment, from that Vlan proxmox host should be accessible.
Then i have two VM - one should have ip addres in 3 of these Vlans, and one in 2 of them.
How best to configure it ? I got bit lost in configuration options.

 

[floh8]

Look in the docu!

 

[Dunuin]

There is an example:
https://pve.proxmox.com/wiki/Network_Configuration#sysadmin_network_vlan

I would use a single vlan-aware bridge. Then add a vlan interface on top of that bridge for your management. VLANs for VMs are tagged in the "hardware" section of your VM config when editing the virtual NIC.

 

[louie1961]

Look in the docu!

Reminds me of working at AWS. SMH...

 

[louie1961]

Here's a working example from one of my Proxmox nodes. You need to edit /etc/network/interfaces, or try to do the same thing in the web ui (I have never done it that way, so I am little help there.) VLAN 100 is the management interface VLAN. I access the Proxmox web UI at 10.10.100.3:8006. None of my VMs or CTs are on this VLAN.

Because it is connected to a trunked port on my managed switch, any VM or CT can access any VLAN. I just select the VLAN when creating the VM or CT. I use DHCP in all of my VMs and CTs and then do IP reservations on the router/firewall side of things


auto lo
iface lo inet loopback

iface eno1 inet manual

auto vmbr0
iface vmbr0 inet static
bridge-ports eno1
bridge-stp off
bridge-fd 0
bridge-vlan-aware yes
bridge-vids 2-4092

auto vmbr0.100
iface vmbr0.100 inet static
address 10.10.100.3/24
gateway 10.10.100.1

 

[louie1961]

Then i have two VM - one should have ip addres in 3 of these Vlans, and one in 2 of them.
How best to configure it ? I got bit lost in configuration options.

I am not 100% sure, but I don't think a VM can have an IP address in more than one VLAN unless you create multiple bridges and attache more than one bridge to a VLAN. I have never tried that. It may be better to give each VM one IP address and have firewall rules in your network that allows the VM to reach services on the other VLANs

 

[Dunuin]

I am not 100% sure, but I don't think a VM can have an IP address in more than one VLAN unless you create multiple bridges and attache more than one bridge to a VLAN. I have never tried that. It may be better to give each VM one IP address and have firewall rules in your network that allows the VM to reach services on the other VLANs

You only need a single vlan-aware bridge. For a VM in multi vlans you got two options:
1.) a single vNIC and you don't set a "VLAN Tag" in the vNICs settings. In this case the guestOS got access to all vlans on that bridge and vlan config has to be done inside the guestOS.
2.) you create one vNIC for each vlan and connect all those vNICs to that single vlan-aware bridge. Set the "VLAN Tag" field in the vNICs settings for each vNIC so each vNIC is serving another vlan. This way PVE is handling all the tagging and all the guestOS is seeing are untagged packets (so no VLAN config required inside the guestOS).