Configuring VLANs in Proxmox: A Guide to enable tag for VLAN in Linux bridge

Diving into the world of Proxmox to configure VLANs? You’re in the right place. Whether setting up a virtual lab, enhancing security, or streamlining network performance, understanding how to manage VLANs in Proxmox effectively is key. This article will walk you through each step, ensuring you can leverage the full power of VLANs to optimize your network’s efficiency and security. Let’s get started and make VLAN configuration in Proxmox a breeze.

What is a VLAN?

A VLAN, or Virtual Local Area Network, is a technology that lets you split a single physical network into multiple virtual networks. Each VLAN acts as its separate network, allowing devices to communicate as if they were on the same physical network, even if they’re not. This setup is great for organizing your network into smaller, more manageable sections, enhancing security, and improving network performance.

How does Proxmox Server set up the network on a node?

Proxmox Server uses a model where each node can have multiple network interfaces, both physical and virtual. You typically create bridges when setting up the network on a Proxmox node. These bridges act as virtual switches to which both your physical and virtual machine (VM) network interfaces connect, enabling communication between VMs and between VMs and the outside world.

Creating VLAN-Aware Linux Bridges

To set up VLANs in Proxmox, you must first create VLAN-aware Linux bridges. A Linux bridge works like a virtual switch that connects your VMs to the physical network. Making this bridge, VLAN-aware allows it to understand VLAN tags and segregate traffic accordingly.

In the image below, you notice Proxmox created two physical network interfaces, eno1 and eno2. vmbr0 is the Linux bridge.

Highlight the vmbr0 Linux Bridge and click ‘edit’. You need to mark the checkbox ‘VLAN aware’ and then click ‘Apply Configuration.’ That’s all. The Proxmox Server is ready for vLans. In this example, you also see the management IPv4 address of the Proxmox node and the Gateway. I didn’t use IPv6, so the fields are empty.

If you want, you can go to the command line (shell) in the Proxmox WebGui or use Putty to check the configuration of the nic before you click ‘VLAN aware”

nano /etc/network/interfaces

Below is the network interfaces after making the Linux bridge VLAN aware

Basically, Proxmox has now created a VLAN trunk for all possible VLANs from 2-4094. VLAN1 is for the native network. You are free to change the configured VLAN, for example to

bridge-vids 2,10,15,20,100

When you want to limit the bridge to allow traffic only from specific VLANs, you would use the bridge-vids parameter to specify the permitted VLAN IDs. The above example would indicate that only VLANs with IDs 2, 10, 15, 20, and 100 are allowed on the bridge.

Integrating Proxmox Network with Physical Networks

Once you’ve made your Linux bridge in Proxmox VLAN-aware, the next step is to ensure that your Proxmox network configuration works harmoniously with your physical network setup. This integration allows virtual machines (VMs) within Proxmox to communicate efficiently with devices outside the Proxmox environment, including the internet, other servers, and workstations on your network. Here’s how you can achieve this:

1. Understand Your Physical Network’s VLAN Configuration

Before integrating your Proxmox server with the physical network, it’s essential to understand your existing network’s VLAN setup clearly. This includes knowing the VLAN IDs, configuring your switches to handle VLANs, and which ports are tagged or untagged for specific VLANs.

2. Configure Physical Switch Ports

Below you see an example of a VLan configuration at a Fortigate firewall.

3. Match VLAN IDs

Ensure the VLAN IDs used in Proxmox match those configured on your physical switches. Inconsistencies between VLAN IDs can lead to communication failures. For instance, if a VM in Proxmox is tagged with VLAN 10, the physical switch port connected to the Proxmox server must also allow VLAN 10 traffic.

Configure VLANs on Virtual Machines

Assigning VLANs to virtual machines (VMs) in Proxmox VE is essential for network segmentation, enhancing security, and optimizing network traffic. Here’s how to directly assign VLANs to your VMs, ensuring they communicate effectively within their designated network segments.

Assign VLANs to VM Network Interfaces

• Access Proxmox Web Interface: Log into the Proxmox VE web interface using your credentials.
• Select Your VM: Navigate to the left panel, find the VM you want to configure and click on it to select.
• Edit Network Interface:
• Enter VLAN Tag:
• Save Configuration: Click OK to save the changes. This action updates the VM’s network interface to use the specified VLAN tag for its traffic.

Configure Network Settings Inside the VM

After you’ve assigned a VLAN to the VM’s network interface, you might need to configure the network settings within the VM’s operating system to ensure it correctly uses the designated VLAN’s network configuration:

This step is not necessary when you configured DHCP for your VLAN ID.

• Log into the VM: Access the VM’s console or connect via SSH, depending on your setup and preferences.
• Set IP Configuration: Configure the VM’s network interface with an IP address, subnet mask, and default gateway appropriate for its assigned VLAN. The exact steps depend on the VM’s operating system. For Linux VMs, this usually involves editing. /etc/network/interfaces. For Windows VMs, you’ll adjust the settings through the Control Panel or Settings app.

Testing and Verification

Troubleshooting VLAN network configuration Issues on Proxmox

Encountering issues while configuring VLANs in Proxmox can be frustrating, but most problems can be resolved by following a systematic approach. Here are steps to diagnose and fix VLAN network configuration issues:

Verify VLAN Configuration

Check Physical Switch Settings

Test Network Connectivity

Review Firewall and Security Settings

FAQ

I would love to get some feedback from you. Was this article helpful? Please share your opinion with me in the comment section below. Or, if you prefer a more personal touch, feel free to email me directly at info@edywerder.ch. Your thoughts and insights are always appreciated. Additionally, you can connect with me on Reddit at Navigatetech.