Configuring VLANs on a Host for Proxmox VE

Configuring VLANs on a Host for Proxmox VE.png
Configuring VLANs on a Host for Proxmox VE.png

Pic from unsplash

In to­day's in­creas­ingly com­plex net­work­ing en­vi­ron­ments, Vir­tual Lo­cal Area Net­works (VLANs) have be­come a cru­cial tool for man­ag­ing net­work traf­fic and en­sur­ing op­ti­mal per­for­mance.

This blog post pro­vides a step-by-step guide on con­fig­ur­ing VLANs on a host for Prox­mox Vir­tual En­vi­ron­ment (VE), a pop­u­lar open-source vir­tu­al­iza­tion plat­form.

Why use VLANs with Proxmox VE?

VLANs al­low you to seg­re­gate net­work traf­fic into iso­lated broad­cast do­mains, im­prov­ing se­cu­rity and re­duc­ing net­work con­ges­tion. By con­fig­ur­ing VLANs on a Prox­mox VE host, you can:

  1. Improve network performance by reducing broadcast traffic.
  2. Enhance security by isolating sensitive virtual machines (VMs) and containers.
  3. Simplify network management and troubleshooting.
Prerequisites
Be­fore pro­ceed­ing, en­sure you have the fol­low­ing:
  1. A Proxmox VE host installed and configured.
  2. A managed network switch that supports VLAN tagging (IEEE 802.1Q).
Procedures:

This guide pro­vides pro­ce­dures for con­fig­ur­ing VLANs on a host for Prox­mox Vir­tual En­vi­ron­ment (VE).

This guide pro­vides in­struc­tions for con­fig­ur­ing VLANs, with sep­a­rate sec­tions for both the com­mand line in­ter­face (CLI) and the graph­i­cal user in­ter­face (GUI).

The Command Line Interface (CLI) Configuration
Step 1: A Proxmox VE host configurration

Edit con­fig­u­ra­tion file for the VLAN in­ter­face in /etc/network/interfaces.

vi /etc/network/interfaces

The eno1 is a phys­i­cal net­work in­ter­face and vmbr0 is a Linux Bridge.

the fol­low­ing con­fig­u­ra­tion, ad­just­ing the address and gateway pa­ra­me­ters as needed

Use VLAN 2 for the Prox­mox VE man­age­ment IP with VLAN aware Linux bridge
auto lo
iface lo inet loopback

iface eno1 inet manual

auto vmbr0.2
iface vmbr0.2 inet static
        address 10.2.2.254/24
        gateway 10.2.2.1

auto vmbr0
iface vmbr0 inet static
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 1-4094

Save the file and exit the ed­i­tor use :wq

Ap­ply the new con­fig­u­ra­tion by restart­ing the net­work­ing ser­vice:

systemctl restart networking
Step2: Configure a managed Network Switch
In this sce­nario, use Cisco SG300-10P 10-Port Gi­ga­bit Man­aged Switch.

The com­mand "enable" is used to en­ter priv­i­leged EXEC mode on a Cisco SG300-10 switch, which al­lows ac­cess to con­fig­u­ra­tion and man­age­ment com­mands.

enable

The sub­se­quent com­mand "configuration terminal" is used to en­ter global con­fig­u­ra­tion mode, which al­lows the user to con­fig­ure var­i­ous as­pects of the switch's be­hav­ior.

configuration terminal

The com­mand "interface gigabitethernet2" is used to se­lect the Gi­ga­bit Eth­er­net in­ter­face 2 on the switch for con­fig­u­ra­tion.

The com­mand "description VMS01" is used to as­sign a de­scrip­tion to the se­lected in­ter­face, in this case la­bel­ing it as "VMS01", which stan­dard for Vir­tual Ma­chine Server.

The com­mand "switchport trunk allowed vlan add 2-4,11" is used to con­fig­ure the se­lected in­ter­face as a trunk port and al­low traf­fic from VLANs 2, 3, 4, and 11 to pass through the port. The "add" key­word spec­i­fies that these VLANs should be added to the ex­ist­ing list of al­lowed VLANs, if any.

interface gigabitethernet2
description VMS01
switchport trunk allowed vlan add 2-4,11
Step 3: Assign VLAN to VMs or Containers

Fi­nally, as­sign the newly cre­ated bridge to your VMs or con­tain­ers:

This sam­ple use con­tainer.
  1. Select the desired container in the Proxmox VE web interface.
  2. Go to the Network tab.
  3. Click Edit.
  4. Select the bridge (e.g., vmbr0) from the Bridge dropdown menu.
  5. Assign a vlan number in VLAN Tag
  6. Click OK to apply the changes.

Re­peat these steps for each con­tainer you want to as­sign to the VLAN.

2023-03-24_141304.png
2023-03-24_141304.png

no VLAN as PVID vlan1

2023-03-24_141340.png
2023-03-24_141340.png

2023-03-24_141414.png
2023-03-24_141414.png

Graphical User Interface (GUI) Configuration
Step 1: Configure Proxmox VE Network

Now, cre­ate a new Linux Bridge or Open vSwitch in the Prox­mox VE web in­ter­face:

  1. Log in to the Proxmox VE web interface.
  2. Go to Datacenter > vms02 (your-node) > System > Network.
  3. Click "Create > Linux Bridge" or " Edit the Existing vmbr0 of Linux Bridge" (depending on your preference).
  4. Add the VLAN interface to the Bridge ports field.

2023-03-24_133246.png
2023-03-24_133246.png

2023-03-24_132715.png
2023-03-24_132715.png

2023-03-24_133233.png
2023-03-24_133233.png

Step2: Configure a managed Network Switch

2023-03-24_095806.png
2023-03-24_095806.png

PVID (De­fault Vlan ID) as 1

2023-03-24_095945.png
2023-03-24_095945.png

Con­fig­ure the GE2 in­ter­face as a Trunk port and al­low traf­fic from VLANs 2, 3, 4, and 11 to pass through the port, with VLAN1 as the De­fault Vlan with­out Vlan Tag.

Conclusion
By fol­low­ing this guide, you've suc­cess­fully con­fig­ured VLANs on a Prox­mox VE host and as­signed them to your VMs and con­tain­ers. This will help you op­ti­mize net­work per­for­mance, en­hance se­cu­rity, and sim­plify net­work man­age­ment in your vir­tual en­vi­ron­ment.
Reference:
Related: