View source for Setup Simple Zone With SNAT and DHCP

This guide demonstrates how to utilize Proxmox VE's software-defined network (SDN) to implement Source-NAT (SNAT), or masquerading, for providing internet access to guests within private networks

=== Installation ===

In order to use the automatic DHCP feature you need to additionally install dnsmasq. You can do this via the following command:

 apt install dnsmasq

Additionally, you should disable the default dnsmasq service:

 systemctl disable --now dnsmasq

=== Configuration ===

Navigate to 'Datacenter > SDN > Zones' and create a new Simple zone with an ID of your choice. For activating DHCP, also tick the 'automatic DHCP' option in the advanced settings. As IPAM we select pve, which is available by default in SDN. In order to use the IPAM features described below, you need to use the 'pve' IPAM.

Navigate to the VNet panel to create a new VNet with an ID of your choice (<code>vnet0</code> in our example). When creating the VNet, select the zone we created in the previous step.

In the same view, create a Subnet in the previously created VNet. This can be done by selecting the VNet and clicking 'Create' in the Subnet panel on the right-hand side. Enter a local Subnet of your choice (in our example <code>10.0.0.0/24</code>). You also need to define an IP for the gateway, otherwise DHCP will not work (<code>10.0.0.1</code> in our example). Tick the 'SNAT' option in order to enable SNAT for this VNet.

To use DHCP we also need to create a DHCP range for this Subnet. This can be done by switching to the Tab 'DHCP Ranges' in the Subnet creation dialog. I picked <code>10.0.0.50</code> and <code>10.0.0.200</code> as my start and end addresses for the DHCP range.

<gallery>
Simple zone dhcp.png|Zone Configuration
Vnet configuration.png|VNet Configuration
Subnet configuration.png|Subnet Configuration
Dhcp range configuration.png|DHCP range configuration
</gallery>

Now that everything is set up, we need to apply the changes. This can be done by navigating to the SDN panel and clicking 'Apply'. Make sure that the network reload task finishes successfully. If it does complete without any errors or warnings you should be able to use your newly created VNet.

==== Firewall Setup ====

If you use the PVE firewall, you will also need to allow DHCP forwarding and DNS traffic on the VNet interface. Otherwise, your guests won't be able to contact dnsmasq for DHCP leases and DNS queries. To do so, add two rules to your datacenter firewall: one for DNS queries and one for DHCP forwarding. Both rules should use direction "in", action "ACCEPT", and the VNet name as the interface name (<code>vnet0</code> in our example). You can use the "DNS" and "DHCPfwd" macros for each rule respectively.

For the DNS rule, you should additionally set the destination address to the gateway of the network. This allows only DNS traffic for the dnsmasq server. If you don't set it all DNS traffic will be allowed, which could be used to circumvent other firewall rules. DHCP cannot be restricted in the same manner, as it needs to be able to issue a broadcast message at first. Finally, mark both as enabled and save the rules. See the below screenshots for more information. 

<gallery>
DHCP forwarding rule.png|Rule to allow DHCP forwarding on vnet0
DNS Accept Firewall Rule.png|Rule to allow DNS traffic on vnet0
</gallery>

=== Container ===

Create a container with your desired settings. When you configure the network, select the VNet as your bridge and set IPv4 and / or IPv6 to DHCP depending on the subnets you configured.

[[File:Container network config sdn dhcp.png|thumb|CT network configuration]]

When starting your CT you should now be able to see that your container got assigned its IP via DHCP. Verify that SNAT is working by pinging a domain outside your simple zone.

=== Virtual Machines ===

Create a virtual machine with your desired settings. When you configure the network, select the VNet as your bridge. You also need to make sure to configure your guest to use DHCP. Most operating systems default to using DHCP for network configuration, so usually you do not need to do anything.

When starting your VM you should now be able to see that your VM got assigned its IP via DHCP. Verify that SNAT is working by pinging a domain outside your simple zone.

[[File:Vm network configuration sdn dhcp.png|thumb|VM network configuration]]

=== IPAM ===

You can inspect the currently leased IPs in your Simple Zone by navigating to the IPAM tab in the SDN section. There you should now see entries for every VM and CT you created.

[[File:Ipam.png|thumb|IPAM panel]]

You can also edit and create new mappings in the IPAM via this interface. You need to restart the guest via the Proxmox Web UI or CLI in order for the changes to take effect. Restarting the guest from inside does not suffice.

=== Custom DNS ===

Dnsmasq also automatically provides DNS for the whole VNet and uses the DNS configuration of the host for that. If you want to configure a custom DNS server for the VNet, you need to set it in the Subnet configuration. This can be done by editing the file <code>/etc/pve/sdn/subnets.cfg</code> and setting the <code>dhcp-dns-server</code> configuration key. For our example configuration the file would then look like this:

 subnet: dhcpsnat-10.0.0.0-24
 	vnet vnet0
 	dhcp-range start-address=10.0.0.50,end-address=10.0.0.200
 	dhcp-dns-server x.x.x.x
 	gateway 10.0.0.1
 	snat 1

[[Category: HOWTO]]
[[Category: SDN]]