Network Model
From Proxmox VE
Proxmox VE uses a bridged networking model. Each host can have up to 4094 bridges. Bridges are like physical network switches implemented in software on the Proxmox VE host. All VMs can share one bridge as if virtual network cables from each guest were all plugged into the same switch. For connecting VMs to the outside world, bridges are attached to physical network cards assigned a TCP/IP configuration. For further flexibility, VLANs (IEEE 802.1q) and network bonding/aggregation are possible. In this way it is possible to build complex, flexible virtual networks.
The network configuration is usually changed using the web interface. Changes are stored to /etc/network/interfaces.new, and are activated when you reboot the host. Actual configuration resides in /etc/network/interfaces. The following examples list the contents of that file.
Contents |
Default Configuration (bridged)
The installation program creates a single bridge (vmbr0), which is connected to the first ethernet card (eth0).
auto lo
iface lo inet loopback
auto vmbr0
iface vmbr0 inet static
address 192.168.10.2
netmask 255.255.255.0
gateway 192.168.10.1
bridge_ports eth0
bridge_stp off
bridge_fd 0
Virtual machine behave as if they were directly connected to the physical network. The network, in turn, sees each virtual machine as having its own MAC, even though there is only one network cable connecting all of these VMs to the network.
Routed Configuration
Most hosting providers do not support the above setup. For security reasons they disable networking as soon as they detect multiple MAC addresses on a single interface.
A common setup is a public IP (assume 192.168.10.2 for this example), and additional IP blocks for your VMs (10.10.10.1/255.255.255.0). For such situations we recommend the following setup:
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 192.168.10.2
netmask 255.255.255.0
gateway 192.168.10.1
post-up echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
auto vmbr0
iface vmbr0 inet static
address 10.10.10.1
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0
Masquerading (NAT)
In some cases you may want to use private IPs behind your Proxmox host's true IP, and masquerade the traffic using NAT:
auto vmbr1
iface vmbr1 inet static
address 10.10.11.1
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '10.10.11.0/24' -o eth0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.10.11.0/24' -o eth0 -j MASQUERADE
Unsupported Routing
Physical NIC (eg., eth1) cannot currently be made available exclusively for a particular KVM / Container , ie., without bridge and/or bond.
Naming Conventions
- Ethernet devices: eth0 - eth99
- Allowable bridge names: vmbrn, where 0 ≤ n ≤ 4094
- Bonds: bond0 - bond9
- VLANs: Simply add the VLAN number to the ethernet device name, seperated by a period. For example "eth0.50"
