How To Create VLANs in Proxmox For a Single NIC

In this video, we show you how to configure Proxmox to support VLANs on a single NIC
We show you how to re-configure the management interface created during the installation so that it is in your management VLAN
NOTE: Because we are switching to VLANs, the hypervisor will now no longer be accessible. However, connectivity will be restored in the next step so make sure you have the means to modify the network switch attached to the hypervisor
Then we cover how to configure a network switch to support the VLAN tagging that Proxmox will now be doing
Next, we show you how to add additional VLAN interfaces to Proxmox so it can access shared storage for instance
And then how to configure virtual machines to support VLAN tagging
Useful links:
pve.proxmox.com/wiki/Network_...
=============================
SUPPORT THE CHANNEL
Donate through Paypal:
paypal.me/DavidMcKone
Donate through Buy Me A Coffee:
buymeacoffee.com/dmckone
Become a monthly contributor on Patreon:
/ dmckone
Become a monthly contributor on KZbin:
/ @techtutorialsdavidmckone
==============================
==============================
MEDIA LINKS:
Website - www.techtutorials.tv/
Twitter - / dsmckone1
Facebook - / dsmckone
Linkedin - / dmckone
Instagram - / david.mckone
==============================
Steps taken
1) Configure Proxmox
The default installation creates a dedicated management interface so we need to reconfigure Proxmox with a management VLAN interface instead and make the Linux bridge VLAN aware
The quickest way is to edit the /etc/network/interfaces
For example,
cp /etc/network/interfaces /etc/network/interfaces.bak
nano /etc/network/interfaces
auto lo
iface lo inet loopback
iface enp0s25 inet manual
auto vmbr0.100
iface vmbr0.100 inet static
address 192.168.100.10/24
gateway 192.168.100.254
auto vmbr0
iface vmbr0 inet manual
bridge-ports enp0s25
bridge-stp off
bridge-fd 0
bridge-vlan-aware yes
bridge-vids 2-4092
Then we reboot Proxmox to make sure the changes are applied
2) Configure Switch
Because Proxmox is now doing VLAN tagging but the network switch is not, we cannot access Proxmox remotely anymore so we need to reconfigure the switch port
We need to turn the port into a trunk port i.e. one which supports multiple VLANs and set the default, PVID or native VLAN to something unused
Once this is done, the switch will send VLAN tagged traffic to Proxmox and our connection will be restored
3) Add VLAN interfaces to Proxmox
Proxmox will now have a VLAN aware bridge, which means we can add VLAN interfaces to it to give it direct access to a storage VLAN for instance
To do this select the computer in the left hand pane, navigate to System | Network and from the Create drop down menu select Linux VLAN
Change the name to match the bridge and VLAN ID, for example for VLAN 200, we'd use vmbr0.200
Give the interface an IP address and mask, for example, 192.168.200.10/24
Then click Create
On the switch, update the port connected to Proxmox to allow this VLAN
Proxmox should now have access to other computers on your network in this VLAN
4) Assign VMs to VLANs
Because Proxmox and the switch are using VLAN tagging, virtual machines will need to support these as well
For existing virtual machines, select the VM in the left hand pane then select Hardware
Click on the Network Device then click Edit
In the VLAN Tag field, enter the VLAN ID then click OK
On the switch, update the port connected to Proxmox to allow this VLAN if that hasn't already been done
You will need to repeat this for any other interfaces the VM has
For new virtual machines, you can add the VLAN tag as part of the installation process when you get to the Network tab
Credits:
LoveLife | Instrumental Prod. Blue Mango | EQMUSEQ.COM by Don Da Vinci
soundcloud.com/eqmuseq/loveli...
proxmox vlan tagging,proxmox vlan aware,proxmox vlan bridge,proxmox vlan trunk,proxmox vlan aware linux bridge,proxmox vlan single nic,proxmox vlan interface,proxmox single nic vlan,proxmox networking,proxmox networking tutorial,proxmox networking vlan,proxmox,proxmox ve,virtualization,proxmox tutorial
00:00 Intro
00:40 Overview
01:33 Configure Proxmox
10:04 Configure Switch
17:24 Add VLAN interfaces to Proxmox
23:38 Assign VMs to VLANs
Proxmox VLANs Single NIC

[@TechTutorialsDavidMcKone]

If you want to learn more about Proxmox VE, this series will help you out kzbin.info/www/bejne/qXm6ioiqZbtgmZo

[@spyrito79]

Hi. Excuse me for my bad english but i need to know a thing atherwise i’m going to continue not understand. The unique thing i know is your proxmox server is connect to the port 1 of the cisco managed switch but…. What is the switch number port in which your physical pc is connected? Thanks

[@jeffharwood624]

Yes, I know. I created some Diamond route vlans that way. I am retired cyber. But theres an old saying, If it is problematic or down right stubborn to work with from a time perspective, it's just not worth it. I was using old dell 1950's and 2950's pre R series. Late last year ordered 15 each Supermicro 1124's and 2124's for storage clusters with M2's, but then the pandemic and supply shortages hit. Anyway, I was reassured from a colleague that a fanless j1900 could run that. I just ran PTT (path to target) analyzer (my creation) which reads code during transit on install or inside a network for errors. There are only two copies of that in the world. But, I think the servers were too old or damaged (ransomware recoveries) Failing DRAC's, Bios and Network controllers. I am old and impatient, so when I saw the write history on the various forums, I may have over overeacted. long stem complaints over that one issue. Two things came to mind, server corruption or certificate issues.

[@tinashechipomho]

Man your video helped me so much I was stuck

[@itcomesinewaves]

Hands down the best explanation I've seen of VLANs and how to set them up. It's easier to understand an abstraction like this when you have someone explain the principles behind it, rather than just saying click this button and type xyz and voila! And way easier to transfer it to different equipment because you go over *why* you're doing each step and *what* that step actually does...and knowing what the goal is makes it easier to accomplish even on different equipment. Many thanks.

[@TechTutorialsDavidMcKone]

Thanks for the feedback, always appreciated And good to know the video was useful

[@CyberTronics]

Exactly what I needed to do configure mgmt on a sub interface. Thank you !

[@TechTutorialsDavidMcKone]

Thank you very much

[@laughingpain3006]

Thank you so much. This is one of the best explanations as to how and why VLANS are set up and used. Awesome stuff.

[@TechTutorialsDavidMcKone]

Thanks for the feedback, always appreciate And glad this was helpful

[@tarekt.4008]

Big thanks. I like that you are explaining beyond your setup and hardware. That's something a lot of KZbinr forgets to do. Not everyone uses the same Hardware (Switch). So again big thanks and greetings from Germany.

[@TechTutorialsDavidMcKone]

It is difficult to cover everything in one video because as you say, different folks will use different hardware So good to know you found the video useful

[@UltimateJiuJitsu]

Amazing Explanation! Thank you very much David for your help on this subject! I have a my Proxmox installed on a server with 4 NICs and because I had 4 NICs I just plugged each individual one into it's own VLAN tagged switch port. I read many forum posts and the Proxmox docs etc. on this subject but could never quite get my head around it. After watching this video it's given me a much better understanding on whats going on between Proxmox and my Network. Thanks again!

[@TechTutorialsDavidMcKone]

Glad it helped!

[@yousefduaa9255]

Thanks, now I can say I understand VLAN, was searching for "adding active listener interface to prox" and found this. Never understand VLAN before, but now I do. Thanks

[@TechTutorialsDavidMcKone]

Thanks for the feedback, and good to hear the video was helpful

[@J0nny5]

David, thank you so very much for this video. I've wanted to understand/learn VLANs at a great depth, and was hoping to learn with Proxmox. This is it, you did it, can't wait to reconfigure my home lab from subnetting to subnetting + VLANs.

[@TechTutorialsDavidMcKone]

Thanks for the feedback and good to hear the video was helpful

[@ckchessmaster]

I'm working on migrating from ESXi to Proxmox and this video was very helpful in getting my networking set back up. Thank you!

[@TechTutorialsDavidMcKone]

I was using ESXi for a long long time but I do prefer Proxmox VE now Good to know this video was helpful

[@woodsy900]

omg thankyou!!!!!!!!!! I followed the steps in the description and im not a complete noob to networking but proxmox adds the virtual layer! my god its been an adventure but your reminder explanation of setting native vlans got me and as soon as I set my native vlan on my trunk port!!!!!! YOU SAVED ME

[@TechTutorialsDavidMcKone]

Thanks for the feedback and good to hear the video was helpful

[@fanaticdavid]

Thank you, thank you, THANK YOU! With this video, I finally have VLANs working in Proxmox! Not only am I new to Proxmox, understanding how VLANs work is something I've been struggling with for quite some time now. With your explanation, I was able to apply the theory on my UniFi network gear. Most helpful video I've watched in a long time! I had a gut feeling that I needed to take the time to watch this video all the way through and I was right.

[@TechTutorialsDavidMcKone]

Good to know the video was helpful and thanks for the feedback

[@eric169eric169]

Have been able to had vlan to proxmox with our Unifi gear? I try without success, I can't pass the second step

[@TechTutorialsDavidMcKone]

@@eric169eric169 I haven't used Unifi switches if that's what you're referring to I don't know the exact process for configuring them but I assume it's fairly similar

[@warwickemanuel1088]

I learn, not by just doing, but by gaining something of the principles behind what I'm doing, as I'm doing it. Anyone can show me how to hit my head against a brick wall, but why am I? This video is an excellent, well rounded, HOWTO. I've learnt way beyond just "how to". It gives reasons why, how (including why not to do something) and what to expect after doing it. This is not a visual representation of a list of written instructions, something I can read anywhere. For me it's by a person with expert knowledge and experience, capable of explaining complex issues simply and generously. "The reason why I did it this way ..." is an expert providing guidance and sharing their experience with me. I've just experienced the best HOWTO I've ever followed. Thank you so much!

[@TechTutorialsDavidMcKone]

Many thanks for taking the time to provide such detailed feedback The goal is indeed to explain the why and not just the how And it's through feedback I can learn what is and what is not working

[@alangraham2802]

This got me going in under an hour. Extremely appreciated!

[@TechTutorialsDavidMcKone]

Good to hear the video helped

[@travisjones.online]

Your video was great! I had been having a hard time understanding VLANs and you explained it perfectly, thank you! :)

[@TechTutorialsDavidMcKone]

Thanks for the feedback and good to know the video was useful

[@coollllmann]

Hello sir, you saved tons of time for me. Wish I had come to this video earlier. Loved the part where you describe how PVID implies receiver (Proxmox) will not receive the VLAN tag. I just donated a little on Paypal, thanks again!!!!

[@TechTutorialsDavidMcKone]

Good to know the video was helpful and thank you for supporting the channel

[@ythalorossy]

It was an Audrey Hepburn presentation about VLAN. Thank you very much for sharing.

[@TechTutorialsDavidMcKone]

I do have something in common with her, but it's certainly not acting skill

[@ArifKamaruzaman]

Wow. Now I kinda understand how VLAN work. Thank you!

[@TechTutorialsDavidMcKone]

Good to know this was helpful

[@zenwhozit9502]

Once again, my hat is off to you! Your video was just the right one for getting me out of a pinch and back on track with Proxmox networking. Your videos have become my go to source for learning! It worked for my 4port nic and I appreciate the help!

[@TechTutorialsDavidMcKone]

Glad to know the video was helpful Thanks for the feedback

[@en4ble773]

David, thank You so much. This is exactly what I was looking for. Getting used to from esxi so this video was super helpful! New sub!

[@TechTutorialsDavidMcKone]

Thanks for the feedback and sub, really appreciated it

[@Gunner8070]

Thanks, you've explained it very clearly!

[@TechTutorialsDavidMcKone]

Thanks for the feedback. I really appreciate it And good to hear the video was useful

[@andrew_kopp]

You can do the editing entirely on the web interface. Just do not apply changes after removing IP from first interface. Setup the vlan interface after removing the ip from the main bridge, proxmox wont complain then. After all changes are made - then apply.

[@TechTutorialsDavidMcKone]

Thanks for the feedback, it's really appreciated I think I overlooked that as doing it on other systems usually didn't end well Either the parser complained and refused to let me do it or the change failed resulting in me being locked out due to the way the server applied the changes But now that I've tried it on this version of Proxmox, it is definitely easier if you prefer the GUI Thanks for sharing this

[@F-xf2cd]

Thank you very much for the detailed explanation, sir! Keep up the good work!

[@TechTutorialsDavidMcKone]

Thanks for the feedback, much appreciated Good to the know the video was helpful as well

[@TAL74]

Exactly what I wanted :-) Thanks for the content and keep it up !

[@TechTutorialsDavidMcKone]

Great to hear you found the video useful

[@MrCelenhein]

Thank you for sharing! Gold mine. Thank you!

[@TechTutorialsDavidMcKone]

Thanks for the feedback, much appreciated

[@thomaskogler]

Just perfect!! Thank you!

[@TechTutorialsDavidMcKone]

Good to know the video was helpful

[@andresrocha9579]

Excelent tutorial, it works perfect, just what i need it. Thanks a lot!!!

[@TechTutorialsDavidMcKone]

Thanks for the feedback and good to know the video helped

[@jorgeluisamarilla661]

Thanks! Save our Sunday migration in one client just an hour ago!

[@TechTutorialsDavidMcKone]

Thanks for the feedback, I appreciate it And good to hear this video was useful to you

[@MaxKulik]

This is a very helpful video! Thanks for making this!

[@TechTutorialsDavidMcKone]

Good to know the video helped, so thanks for the feedback

[@akska10]

many thanks for the video.. I've learned different important things from 1 video.

[@TechTutorialsDavidMcKone]

That's great to know Thanks for taking the time to comment

[@cs_cy8er]

I know this is an old video but it helped me fix my vlans and proxmox, thanks

[@TechTutorialsDavidMcKone]

Good to know the video was helpful, so thanks for the feedback

[@markstanchin1692]

Thank you, thank you soo much exactly what I was looking for. I got the vlans set up in Proxmox but I couldn’t get out to the Internet and now I know why. I now have to set up the switch ports.

[@TechTutorialsDavidMcKone]

Thanks for the feedback and good to know the video was useful

[@packetcollection4761]

About time Phil Mitchell started giving out tech tips :D

[@TechTutorialsDavidMcKone]

You're not the first and likely not the last to make that reference

[@AxelGonzalez-ct7nn]

this is gold, thank you

[@TechTutorialsDavidMcKone]

Good to know the video was helpful, thanks for the feedback

[@pandukautsar1375]

You are life saver thank you sir, respect

[@TechTutorialsDavidMcKone]

Good to know the video was helpful, thanks for the feedback

[@WeskuoJob]

Thank you so much, it's working fine for me.

[@TechTutorialsDavidMcKone]

Good to know, so thanks for the feedback

[@JPEaglesandKatz]

Explained well, nice video!! Thanks!!

[@TechTutorialsDavidMcKone]

Thank you for the feedback. It's really appreciated And good to know you found this useful

[@CustomRideOns]

Great video! Very helpful and informative.

[@TechTutorialsDavidMcKone]

Thanks for the feedback and good to know the video was helpful

[@saviovalentim2260]

O único vídeo que conseguiu me ensinar, muito bom!

[@TechTutorialsDavidMcKone]

Obrigado. É bom saber

[@CyberCam1969]

I would love if you could do a video on the Proxmox OVS network setup as well. BTW, I love your videos, I've been binge watching them! Cheers mate!

[@TechTutorialsDavidMcKone]

Thanks for the feedback and good to know the videos are useful Unfortunately OVS isn't a high priority for me At the moment I'm focusing on automating as much as possible, but also monitoring and alerting

[@CyberCam1969]

@@TechTutorialsDavidMcKone I get it... thanks for the reply.

[@jibberjabber6754]

This was good mate

[@TechTutorialsDavidMcKone]

Glad to hear you found this useful I'm using single NIC mini computers myself so thought it would be good to share how to do this

[@mr.agustiono7631]

Thank you so much

[@TechTutorialsDavidMcKone]

Good to know the video was useful

[@bentosan]

Thanks for this, i have been struggling to get this setup and after watching this a couple times its making alot more sense. In unifi if you want to do this vlan id stuff you need to create a new network, put the VLAN id in that network, then assign the port to use that network.

[@TechTutorialsDavidMcKone]

Thanks for the feedback and good to hear you found this video useful For whatever reason vendors like to do things differently I suspect Unifi follow that process you mentioned because for their Wi-Fi you can have multiple SSIDs and the first thing you have to do is to create a network containing the SSID you want

[@jeroenofferman8519]

Excellent

[@TechTutorialsDavidMcKone]

Thanks for the feedback, much appreciated

[@tendaitaruvinga5679]

1+ Subscription, this is really helpful keep it up

[@TechTutorialsDavidMcKone]

Thanks for the sub!

[@pauloramos1735]

boa

[@jimbob12372]

Heard it a work. Was pretty good game.

[@EliSmith]

Thanks!

[@TechTutorialsDavidMcKone]

Thank you

[@packetcollection4761]

Good job :)

[@TechTutorialsDavidMcKone]

Glad you found it useful

[@markstanchin1692]

Have you ever done a video on changing the IP address of a Proxmox HA cluster with Ceph? I’m sub netting my flat network since I ran out of a IP’s so I want to change my proxmox cluster address with subnets, different networks for management console, storage and dedicated 10g Ceph without breaking anything. Thanks for your very well explained videos!

[@TechTutorialsDavidMcKone]

The management interface is easy enough to change as you just add an interface and login to that going forward I did a video for NFS storage as an example, which involves a dedicated interface, so again you just add an interface but you might have to drop the existing storage connection then create a new one that is pointing to the new IP address. It shouldn't be impacting as long as you aren't running VMs on nodes which use that storage, because the change is global By default, the first interface you create is used for migrations, and I did a video to change that. As long as there's no migrations going on it shouldn't be impacting The bigger problem is the interface used for clustering Going by the notes: "Changing the hostname and IP is not possible after cluster creation" pve.proxmox.com/wiki/Cluster_Manager Although you can't change the IP, you should probably be able to go into the CLI and change the subnetting You do have to factor in updating firewall rules for all this, if you're using the PVE firewall solution that is I haven't done anything covering Ceph as it requires too much extra hardware 3 servers is the minimum, but the recommendation is 4 or more and it needs dedicated 10G NICs and one or more switches with enough ports. You could wire the servers in a loop instead but then each server would need 2x10G NICs just for Ceph, plus the additional NICs for everything else In addition, it needs higher grade Enterprise SSDs for instance so I'm not currently planning on putting out videos on Ceph

[@email16v]

Interesting. I setup my proxmox vlans a little bit differently. I assigned the vlan to a vlan bridge and any VM I connect to that bridge will be on that vlan. I created another bridge for another vlan, etc. The VMs get their IP addresses from my pfsense DHCP sever over their respective vlans/bridges. Thanks for showing another way to do it.

[@TechTutorialsDavidMcKone]

Makes sense It's how we used to build physical networks before VLANs became available I do that myself if everything is virtualised as it can help simplify things But I prefer physical firewalls over virtual ones So as all the VMs need to connect to the physical network, it's easier to keep things on a single bridge with a single interface rather than having multiple bridges needing multiple interfaces and thus more switch ports

[@daytrader66]

Very helpful video, thank you. Is any of what you configured in the networking config files specific to Proxmox or all part of regular Debian?

[@TechTutorialsDavidMcKone]

It's done in the Debian operating system so this isn't specific to Proxmox

[@adrianstephens56]

Thanks for the video. I found it very useful. I do have a question, at 24:45 why did you select vmbr0 and then vlan tag 100 vs selecting vmbr0.100 and no vlan tag?

[@TechTutorialsDavidMcKone]

vmbr0 is the Linux Bridge attached to our physical interface vmbr0.100 is a sub-interface i.e. software interface that is created to allow the hypervisor itself to send and receive traffic in VLAN 100 through that bridge When it comes to virtual machines, the VLAN set up process is similar to other hypervisors We configure the virtual machine NIC to be attached to a Virtual Switch or in this case Linux Bridge vmbr0 And then add the VLAN tagging, in this case VLAN 100 Think of it as plugging a cable into a physical switch and then configuring that switch port for VLAN 100

[@nixxblikka]

A long video with a lot of information - I didn’t think this would exist anymore. Great content. Keep going! One question, though, so you set a bridge, make it VLAN aware, you create a subinterface with VLAN 100. on the switch though you use VLAN 4093 for Port 1 - is this the port being connected to Proxmox or is this just the port you use to manage the switch? Because if it the first, how does the connect work?

[@TechTutorialsDavidMcKone]

802.1q has what's known as a native VLAN which is a VLAN used for untagged traffic The network switch and in this case Proxmox VE, have to agree what VLAN this is and the recommendation for security reasons is that you should assign a VLAN that you don't use to reduce the possibility of a computer trying to "jump VLANs" In other words, if a computer has been assigned to VLAN 100, it shouldn't be able to give itself access to VLAN 200 for instance; VLAN hopping So in this example I chose to use VLAN 4093 as the native VLAN For this type of switch the native VLAN is defined by the Primary VLAN ID or PVID Any untagged traffic the switch receives from Proxmox VE will then be placed into VLAN 4093 And any traffic in VLAN 4093 the switch sends to Proxmox VE will be sent untagged With no physical computers, VMs or network devices using that VLAN, that type of traffic will be dropped All other traffic will be tagged with the proper VLAN The laptop is connected to a switch port which tags its traffic with VLAN 100 Proxmox VE has been given a sub-interface which tags traffic with VLAN 100 And so as they belong to the same VLAN, they can communicate directly

[@nixxblikka]

@@TechTutorialsDavidMcKone Thank you very much David for the profound explanation, you are a gentleman!

[@jimbob12372]

Do the nics have to be vlan-aware

[@imranmanan7346]

Hi thank you for the tutorial. Have you considered using the built-in OVS on proxmox? Its like virtual switch on ESXi

[@TechTutorialsDavidMcKone]

OVS is on my to do list, it's just not a priority right now The Linux bridge supports VLANs, which is good enough for now as I prefer a physical firewall over a virtual one

[@imranmanan7346]

@@TechTutorialsDavidMcKone Thank you really look forward to it

[@trikki69]

I don't understand why multiple IP addresses and interfaces are required within pve - Once vlan aware and a mgmt IP address have been set in pve, no more IP addresses should be required. The VMs should be assigned to a vlan and either pickup a dhcp address or statically assign one in the vm itself. Other than the mgmt vlan the other vlans should only exist at layer 2 from pve's perspective unless host to host comms is required e.g. pve's version of vmotion. Great vid and channel - I have subbed! :)

[@TechTutorialsDavidMcKone]

A hypervisor needs to have multiple interfaces for security reasons E.g. you want to restrict, as much as possible, any other way of managing the hypervisor other than through its management interface. So that needs a dedicated interface, behind a firewall and then you reduce which computers can access the management interface, who or what can login to the jump server, etc. Other interfaces are needed for different purposes and for security reasons they too should only be carrying the relevant traffic to reduce the risk of a breach Multiple physical interfaces also bring performance benefits and can avoid connectivity problems When you have a hypervisor cluster you'll want a storage interface, a cluster interface and a migration interface A hypervisor might need to access shared storage or use something like ceph for redundancy reasons. That can result in a lot of traffic being transferred between the hypervisors so it's best to put this on a dedicated interface so that the transfer is as quick as possible, but also so it doesn't slow down other parts of the hypervisor. A large data transfer over the management interface for instance could prevent remote access and then you can't even stop the transfer You can't afford interruptions to cluster traffic or the hypervisors might think one of the nodes is down for instance and that results in contention and problems for VMs. Even if you have a single NIC, having an isolated cluster network using VLAN interfaces still avoids traffic from other computers interrupting the cluster traffic and some computers can be very chatty. Computers have to stop and process broadcast, multicast and unknown traffic in their network even if it's just to throw it away because it's not relevant to them Similar to the storage interface, you should have a dedicated physical migration interface. Even if you have VMs on shared storage, a live migration requires transferring the contents of RAM over the network and that can be several GB. So imagine what happens when several VMs are being migrated And you also need a backup interface. Backups don't always go to plan and nobody likes getting into work to find a backup job didn't complete overnight and is oversubscribing the management interface or user VMs for instance. By keeping backup traffic to a separate interface, you can run backups 24x7, as long as you can handle file locks, BUT you can also do certain restores without interruption

[@lezz27]

Thank you for the video. I have a similar setup where I am running Proxmox on a test laptop and wanted to get started with this solution. But for the whatever weird reason the VM's are not getting an IP from the VLAN DHCP server. I have tried almost all possible combination but nothing seems to be working and I am also at the verge of giving up. The port that my laptop is connected to is a trunk port and pvid for this port is set to a vlan id that I am never gng to use)as suggested in the video). I have a router on stick PFsense install that acts as my router/dhcp server. I have quite a bit vlan's and the reason for testing Proxmox to see if I can create multiple VM's on different vlans without much trouble. Aparently, that's hasn't been the case so far.

[@TechTutorialsDavidMcKone]

Usually when traffic doesn't get to where it needs to be, it would be a VLAN tagging issue If you're familiar with tcpdump, you can install and run that on Proxmox to see what the DHCP traffic is up to But if Windows is more your thing then configure the switch to mirror traffic from the pfsense and Proxmox ports to another switch port Plug a Windows computer into that port and you can monitor the traffic exchange using Wireshark If you don't see DHCP requests being sent out from Proxmox, then you need to check that port and the VMs for tagging Or if you don't see any replies from pfsense then you need to check that port and the VLAN tagging on pfsense

[@CyberTronics]

absolutely fantastic video breaking down VLANS (a concept that goes over my head the more I look into it). i have a question: when traffic hits proxmox, is it hitting proxmox first or the bridge? so if my switch is connected to my server, I visualise it on my diagrams as though my cisco switch directly connects to vmbr0, thus 2 swithces connected via a trunk port - is this a fair accurate way to view it?

[@TechTutorialsDavidMcKone]

Proxmox VE is taking advantage of the underlying Debian OS which does the virtualisation and networking So traffic hits the physical switch, and with a Linux bridge attached to it, the bridge then decides what to then do with that traffic

[@user-om1dg1sr1l]

Nice video as always. I have a small home network and I'm setting up a 3 node cluster with PVE, The bare metal NAS will become a VM, the firewall VM and a couple other VMs will be run with HA. Instead of creating a separate VLAN for the cluster on my single motherboard gig network port, would there be a noticeable improvement in cluster performance if I ran a separate gig port for the cluster? I have limited gig ports available because of the firewall but if you feel the cluster would operate better on a dedicated port I'd allocate them.

[@TechTutorialsDavidMcKone]

It's not so much about the performance but availability For a cluster interface you need to make sure there aren't interruptions So it all depends on the traffic throughput if all you have is one interface Ideally you want separate interfaces for the different traffic purposes Backup and data transfers for instance might take full advantage of a link and if that's shared by cluster traffic it can cause problems

[@user-om1dg1sr1l]

It's like somebody turned on a light switch. Between this answer and a couple other ones you responded to I think I have a good idea on how clusters and HA all work together.

[@bwis16]

Is there a way to make it so that in your case, the VM on VLAN 200 can have access to the internet? What settings would you have to change for that? Thanks for such a great video.

[@TechTutorialsDavidMcKone]

To have access to the Internet it's best to use a firewall So in this case the firewall would have an interface that connects to the Internet Router and another connected to a switch The interface attached to the switch would have a sub-interface in VLAN 200 and computers in VLAN 200 would then use the firewall's IP address in VLAN 200 as their default gateway

[@bjornarsimonsen7592]

For some reason VLANs confuse me. I think it's because I don't actually have a lab in which to play around and I've never actually set up VLANs before. I've seen a few videos and most of them will typically do something I don't really understand and then just very briefly mention what it does, but without giving a proper explanation. In this video you said traffic entering on one port will be sent out to another (port 8 to 1), but you didn't say anything about why that is I think, or at least it wasn't given a thorough explamation. Typically what happens to me then is I start to zone out. I need a lab with a proper managed switch and more than one device in the network so that I can play around with it :) Watching videos alone without the ability to participate isn't enough. I do however have a dedicated server in the cloud running Proxmox and soon it will have many servers that will have to be grouped into a few networks, so I believe I'll need tio set up some VLANs to do that. Or maybe I'll just use different bridges for each network.

[@TechTutorialsDavidMcKone]

The best way to learn is through practice Computing has layers and you need to understand the communication at each layer to know how and why traffic flows behave the way they do But the easiest way I can think to explain this is that when a computer needs to talk to another computer it must learn that computer's IP address When they're in the same network, it must then learn its MAC address This all done through discovery processes The computer then sends traffic to the switch port it's plugged into with details containing that MAC address as the destination A switch also learns about MAC addresses and in this case it knows to send traffic from port 8 to port 1 because it will at some point have received traffic on port 8 to know that the computer with that MAC address is connected to port 1 What VLANs do is to add a layer of isolation to switches This allows you to separate traffic on a switch without the need to purchase multiple switches So a computer on port 2 configured for VLAN 100 for instance cannot communicate directly with a computer on port 4 if that's configured for VLAN 200 If they do need to talk then the traffic either has to be sent via a router or firewall for instance Before VLANs existed those computers would have been plugged into separate physical switches and the firewall would have been connected to both switches allowing computers on one switch to talk to the ones on the other, but the communication would have been restricted by the firewall, hence the reason for separating the computers in the first place

[@johndriessen6044]

Hi, thanks for this nice video tutorial. Could you also create a video (or a tutorial) for the following situation? (It isrelated to this one.) - I have a router/modem from my ISP. - I have a laptop (single NIC) running OPNSense. - I have a Netgear GS105Ev2 managed switch.(5 ports) - I have a set of 5 TP-Link Deco M5 devices of which some are connected via a network cable and others via wifi - I have a single NIC PC running Proxmox. I have connected the ISP router to port 5 of the switch. The OPNSense laptop is connected to port 4 of the switch. The main Deco M5 is connected to port 3 of the switch. Except for the OPNSense laptop all laptops, pc's (including the Proxmox PC), mobile phones etc are either connected via wifi to the mesh wifi network defined on the Deco M5 set or via unmanaged switches to the Deco M5 devices. I want to use OPNSense as the firewall (but also use other services like OpenVPN, DHCP, IDS/IPS, CrowdSec etc from OPNSense and its plugins) for all devices connected to the Deco M5 network. I have already read an article from which I configured the following on the Netgear managed switch: port 5 (connected to ISP modem-router): VLAN 99 (WAN interface) - untagged, PVID 99 port 4: (connected to OPNSense laptop): VLAN 99 - tagged, VLAN 1 (LAN-interface) - untagged, PVID 1 port 3: (connected to main Deco M5): VLAN 1 - untagged, PVID 1 port2/port 1: not used, standard config: VLAN 1 - untagged, PVID 1 In addition I want to create several VLANs on OPNSense with the LAN interface as parent. IP addresses (a,b,c,d refer to different numbers): - WAN (provided by ISP) network 192.168.a.0/24 (this one is also known as VLAN 99) - LAN (VLAN 1) network configured on the managed switch 192.168.b.0/24 (OPNSense laptop / gateway 192.168.b.10/24, Netgear switch 192.168.b.11/24, Proxmox PC 192.168.b.12/24) - VLAN_2 (Other Type) network to be configured on OPNSense 192.168.c.0/24 (parent interface: LAN) - VLAN_3 (Other Type) network to be configured on OPNSense 192.168.d.0/24 parent interface: LAN) These VLANs should also be usable on Proxmox (f.e. vmbr0.c and vmbr0.d)., so that I can connect VMs or LXCs to them. How should configure the switch, OPNSense and Proxmox to accomplish this? I have tried to get this to work but did not succeed yet. Thanks in advance for your support.

[@TechTutorialsDavidMcKone]

That's really a lot to cover I am planning to do videos to build a network and the computers/servers that go with it from scratch but it is a while off and even a single video takes a long time to create There are other videos that I need to get through first though as I can only do them before the kit goes into use

[@ghostkaa2]

Thank you for the video. I have installed a proxmox on a minipc and I have a trouble with a very low lan speed on VMs and on proxmox itself. For instance when I try to upload iso to proxmox from my another pc the speed is about 300kb/s. At the same time proxmox has a good speed on internet. Have you ever faced that issue?

[@TechTutorialsDavidMcKone]

So can you download faster from the Internet to Proxmox vs uploading from the PC to Proxmox? And are the files being saved to the same storage on Proxmox? If so then it seems like an issue for the PC or its network connection Either way I would check the network switch for any errors being generated on the ports Another to consider is the NIC on Proxmox, Intel ones tend to do better than Realtek ones

[@ghostkaa2]

@@TechTutorialsDavidMcKone Yes, you're right. I tried to upload an iso from laptop and from ipad - everything is ok. So, something with network on my pc...

[@CGW11]

Great tutorial! Would it also work if the gateway is kept on vmbr0 and thus only declared once? So that only VLAN settings are set on "sub-bridges" like vmbr0.100.

[@TechTutorialsDavidMcKone]

It depends on whether Proxmox has an IP address assigned to vmbr0 At which point it would be used for untagged VLAN traffic i.e. the native VLAN, which isn't recommended Ideally you should assign the gateway to whichever interface Proxmox will use to access the Internet, for updates for instance

[@CGW11]

@@TechTutorialsDavidMcKone Thanks for your reply and clarification. If I understand you correctly: the gateway can be assigned directly on the main bridge, but with the caveat that it will be accessible via the default VLAN. Ideally things should only be set once. Is there some other way to only set gateway once (i.e. not on each sub bridge) and still have the main bridge not accessible via default VLAN? As with everything else, it gets more complex the deeper you go.

[@TechTutorialsDavidMcKone]

@@CGW11 If it helps, you only create Proxmox interfaces and assign them with IP addresses if it's necessary So for instance, you might want a management, storage and cluster interface on the hypervisor The storage and cluster interfaces should be isolated networks for security reasons The storage interface is for fast, direct access to a NAS for instance, but nothing else The cluster interface is for uninterrupted cluster traffic, but nothing else The only need for a default gateway is if you need remote hypervisor access from another management network and access to the Internet for software updates So, the gateway would go on the management interface Although you can put it on the main bridge, but it does need an IP address The VMs themselves will more likely exist in other VLANs and these are what user computers need access to BUT, Proxmox does not need interfaces in these VLANs As long as the VMs have the correct tag on their network interface and the Linux bridge and switch interfaces support that VLAN, it should work fine

[@shivanSpS]

Im new to proxmox so ive been trying to setup vlans, what i just did was to enable vlan aware on the bridge and assign the vlan tag to the vm. (Proxmox recibes untagged traffic for management and tagged traffic for the vms on the same nic). As you said, it is a bad practice to use untagged traffic for management but i cant change that for now. The problem im having, is that somehow the switch (TP-Link T1600-28PS) is sending traffic coming and going from the vm back to the router. For example, im using VLAN 100 for the VM, Proxmox gets that as tagged traffic, some of the ports on the switch are set to VLAN 100 untagged only, so when the VM on VLAN100 tries to "talk" to the pcs that are connected to VLAN100 on the switch as untagged, instead of going directly inside the switch from the tagged port to the untagged ones, it goes to the router, then it returns, limiting the global bandwidth. And everything is on the same network and subnet. I can see the traffic on the router interface, even trought the router does not shows up on tracert. So, i have no idea of what is going on here: its acting as if port isolation is active, but its not. Then i tried doing your way, that is actually very similar, you are placing the management ona VLAN, ignoring untagged traffic and assigning an ip for the hypervisor for a second vlan. I tried this but its the same.

[@TechTutorialsDavidMcKone]

Yes, it sounds like the router is acting as a proxy for the devices because the VM can't reach the PCs directly It could be due to port isolation but also due to Proxy ARP if there is a VLAN mismatch What's the default VLAN or native VLAN for these computer ports? On some types of switches there is no such thing as an access port meaning you have to configure the native VLAN instead and that can cause issues The PCs would need to be in an access port so the switch port would have a native VLAN of 100 but no tagging The Proxmox port needs to be trunked, so the native VLAN would be the management VLAN in this case and VLAN 100 should be allowed for the VMs The router port depends, but if that doesn't support tagging it needs to be an access port with a native VLAN of whatever that VLAN should be and no tagging

[@shivanSpS]

@@TechTutorialsDavidMcKone Yeah i dont think it is a Proxmox thing it is a switch issue, this switch have L2 and L3 features so improbably missing something here. The configuration is petty simple actually, Router has VLAN 1 as untagged, this is default on every router, and have VLAN 100 and 100 as tagged on the router trunk port. Switch has VLAN1 as untagged on port 1 to 4 plus vlan 100 and 110 as tagged, so Port 1 to 4 are the trunk port that maches the configuration on the router. VLAN1 is also the vlan from were the switch gets the IP, i can also give it ips for the other vlans but it makes no difference. Then of the remaining ports are all access ports, the top row has VLAN 100 as untagged, and the botton row VLAN 110 as untagged. So im Connecting Proxmox to port 2 on switch, thats a trunk port, it gets vlan 1 as untagged for management and and vlans 100 and 110 for the vms. And this works as both proxmox and the VMs gets the right ips. It just tha traffic is going to the router when it shouldt, the PCs on the access ports can send traffic to each other whiout going to the router (of the same netowork/vlan). But it does work like that when it goes to a vm that is on the trunk port. It is really, really weird. It should work.

[@lancechong33]

very good video. thanks David. But is it possible for my vm host to connect to my existing network without vlan tagging? my home dont have a complicated switch or router that supports vlan.

[@TechTutorialsDavidMcKone]

If you want to use vlans in a hypervisor but the physical network doesn't support them then what's needed is a gateway But a hypervisor shouldn't be given that role as access to it is meant to be restricted for management purposes only Since your physical network doesn't support vlan tagging a virtual firewall would make sense If you create a new linux bridge in the gui which is vlan aware, you can then assign the interfaces of vms to that along with whatever vlan tags you want to use The firewall vm would need interfaces connected to that bridge which have the relevant tagging. And the number of interfaces just depends on the number of vlans you want to create But to access the physical network, the firewall would also need an untagged interface that connects to the default bridge, same as the pve server itself

[@lancechong33]

thank you so much! @@TechTutorialsDavidMcKone

[@digiground7613]

Thank you for this tuto I struggle a bit to configure my proxmox network. Basically, I need to create a network different to my physicall network where I can put vms that can communicate together like "host - network " in VMWare. Here is the scenario: Let say I have two vms: the first one(FortiGate) should have one interface that access the internet and the second port2 should have access to a pseudo network A. The second vm(windows) should have FGT-port2 as a default gateway in the A network(host network) How should I configure that on proxmox? Thank you for any help or even a good place to understand that.

[@TechTutorialsDavidMcKone]

As ever, it depends You could for instance create a new bridge in Proxmox and connect VMs and the firewall to that for your internal network They don't need VLANs so a different bridge keeps things simple But the other firewall interface depends on the physical network If the hypervisor has multiple interfaces you could dedicate one to the firewall VM for Internet access If not then you need a bridge which is VLAN aware, as shown in the video The firewall could then have an outside interface tagged for a VLAN which provides access to the Internet I wouldn't be keen to provide the firewall with direct access to the Internet myself mind A physical firewall has a hardened OS whereas a virtual firewall sits on top of a hypervisor which is more susceptible And I'd be uneasy even if the interface is being passed directly to the VM

[@digiground7613]

@@TechTutorialsDavidMcKone Thank you sir. I understand. I'm actually doing some lab to pass my NSE7 exam. So I need to have things easy that't why I put the FWL with direct access. Thank you for your time.

[@metafysikos13]

Hello, thank you and congrats for your really good and helpful videos! I am new to proxmox and i want to test it before start using it in production environment. But to do that, i would really need your advise, if that's possible. What i do now in my production environment, im using windows server as hypervisor, with only one physical network interface getting public ip via dhcp. Im using NIC Teaming to create an additional virtual network adapter so I can connect it to my provider's vSwitch, using vlan. When NIC Teaming is ready, i have two virtual adapters, and then I am creating two vSwitches inside Windows HyperV Manager Settings (one vSwitch for local ip - vlan and one vSwitch for public ip). That way my VMs have 1 public IP (which i buy from my provider) and one local IP using VLAN. What can I do to have a similar setup inside proxmox? Thank you in advance.

[@TechTutorialsDavidMcKone]

If there's only one physical NIC then that could remain the physical connection for the Linux bridge If you connect the server direct to an Internet provider though it would be best to install a virtual firewall in the hypervisor As in the video, configure the Linux bridge to be VLAN aware and the physical switch to allow the necessary VLANs to the hypervisor The firewall will need to be assigned vNICs in the Public VLAN and Local VLAN The hypervisor will need a virtual interface itself in a Local VLAN so that it can be managed from there

[@metafysikos13]

@@TechTutorialsDavidMcKone Thank you for your reply. I'm afraid i dont understand what you mean. My server is in a cloud infrastructure so i dont have physical access, or management on providers switches. My server has one physical network adapter, with a public IP assigned from my cloud provider. My server is virtually conected to a vSwitch (VLAN 4005) by which it can communicate with the rest of my private network. In order to that i need another virtual adapter, vlan aware, with proper IP configuration (10.x.x.x/16). In windows (hyperv) envrironments i do that with NIC Teaming, which creates 2 virtual interfaces, one configured with public IP, and one with local IP with vlan tag (4005). Now, in order for my VMs to have similar configuration, in HYPERV settings, i create two different vSwitches, one assigned to virtual adapter with public IP, and the other assigned to the adapter tagged with vlan 4005). When i create a windows VM, there are 2 network interfaces inside the OS, so that way I can config the 1st interface with a new public IP (ordered from my provider), and then i can config the 2nd one with local IP. Im sorry about repeating myself and for the long comment but I cannot find a way to do the same thing in Proxmox. In need my Windows VM to have 1 interface with public IP (no VLAN) and 1 interface with local IP (VLAN 4005) configured. How do i do that?

[@TechTutorialsDavidMcKone]

@@metafysikos13 I would suggest asking your cloud provider for further details The channel is for educational purposes I do provide some assistance for each video but only if it's not quite understand, has mistakes, etc. But I don't provide technical consultation or support

[@metafysikos13]

@@TechTutorialsDavidMcKone I totally understand. My provider won't help me unfortunately. Anyway thank you!

[@ruinunes5346]

Hi there, i do have a question : I have 4 nics, 1 used for vmbr0 bridge and the other 3 i wanted to assign for other networks using tagged vlans. However, i'm not being able to apply this type of configuration because i cannot ping my other networks gateways even though i have my default gateway configured (vmbr0). All is routed correctly within my switches and routers because i'm using a production network and all works on hyper-v hypervisors. I would like to create other bridges with vlan tagging but i can't exit my hypervisor. Would you be so kind to explain how to put in place vlan tagging with multiple nics? i thank you in advance.

[@TechTutorialsDavidMcKone]

It depends what you have in mind, but you could for instance, create a separate bridge for each interface and then assign the relevant interface to a bridge There's the option to use VLAN tagging on each interface to give you more flexibility, similar to what's done in the video with this one NIC Or you could just leave the tagging to the network switch The switch ports these interfaces connect to would also need to support the relevant VLANs you plan to use for these interfaces. If a bridge will be supporting multiple VLANs, then so does the switch port. Otherwise the switch port will be configured for the VLAN the interface should belong to There should only be one default gateway in existence on a computer, especially when firewalls are used The majority of interfaces will only be used for direct connectivity to devices in the IP network configured on that interface Access to the Internet will be via one interface that has been configured with a default gateway If there is some reason to use a specific interface to reach a particular network, but it's not directly accessible, and can't be the interface assigned with the default gateway, then the computer should be configured with a static route which points to a router or firewall that interface can reach directly and that will provide the access needed

[@ruinunes5346]

@@TechTutorialsDavidMcKone thanks for your advice.

[@johndriessen6044]

Hi David, I have a question on the PVID of the ports and the tagging. Suppose the Proxmox Server is connected via an unmanaged switch to the managed switch, let's say like in your example to port 1. When I also add a laptop to the unmanaged switch (so I fact it is connected to the same port of the managed switch), this laptop is sending untagged traffic. I want the laptop to be in VLAN 100 as well just like the Proxmox Server. What should then be the values for the tagging of port 1 and PVID for that port?

[@TechTutorialsDavidMcKone]

Unfortunately the managed switch has no overall control of traffic for devices patched to the unmanaged switch E.g. the laptop will send traffic to the unmanaged switch which will send it straight to the server. So no matter what you configure on the managed switch port, it won't make any difference Ideally you should remove the unmamaged switch and patch everything to the managed switch, or replace the unmanaged switch with another managed one Another option to consider is to configure VLAN tagging on the laptop. Usually it's an advanced NIC setting in Windows for instance

[@johndriessen6044]

@@TechTutorialsDavidMcKone thanks for your reply. So the Proxmox server should be on a different port ideally. If I would replace the unmanaged switch by a managed one, how should I configure the tagging and PVID on the second managed switch? Does this also have consequences for the managed switch I already have?

[@TechTutorialsDavidMcKone]

@@johndriessen6044 Anything on the unmanaged switch, while its connected to port 1, will be on VLAN 100 when it talks to something on the managed switch because the managed switch is deciding that So yes, you could move the server to another port on the managed switch and configure that one the same as port 1 to resolve this If you get another managed switch you'd have to set up a trunk port between the two switches so that they can exchange VLANs And that's the same thing that what was done for the Proxmox server port in the video

[@johndriessen6044]

@@TechTutorialsDavidMcKone thanks again for your fast reply. So when using a second managed switch the configuration on the first managed switch does not have to change (it is already expecting Tags) on port 1. The cable in port 1 goes to (say) port 1 on the second managed switch, which also should be tagged and expecting the vlans 100 and 200. The Proxmox server will be connected to port 2 of mng-switch also tagged and expecting vlans 100 and 200. The laptop could be connected to port 3 of mng-switch, be untagged and vlan 100. I could even use the unmanaged switch to be in port 3 and connect the laptop and other devices to it (all of course in vlan 100 and sending untagged traffic.) Is that correct?

[@TechTutorialsDavidMcKone]

@@johndriessen6044 That makes sense

[@spyrito79]

Hi. Excuse me for my bad english but i need to know a thing atherwise i’m going to continue not understand. The unique thing i know is your proxmox server is connect to the port 1 of the cisco managed switch but…. What is the switch number port in which your physical pc is connected? Thanks

[@TechTutorialsDavidMcKone]

Thanks for asking My physical computer has 2 NICs and was connected to ports 7 and 8 The NIC to access the hypervisors was plugged into port 8, an access port in VLAN 100 The one I used to test the VM for instance was plugged into port 7, an access port in VLAN 200 Hope that helps

[@reuben-rt]

Is the only reason for creating a new sub-interface VLAN from the gui - to enable management access to the Proxmox ui to whichever vlan you specify? Does this enable any additional communication between VMs or is that all handled by the main vlan aware bridge?

[@TechTutorialsDavidMcKone]

Normally a VM doesn't need to talk to the hypervisor but the hypervisors do need to talk to each other and to other computers E.g. we need to have remote management access of Proxmox, it needs to talk to our NAS, DNS server, etc. and clustered servers need to communicate The sub-interfaces being created are specific to Proxmox itself and have no bearing on the VMs The VMs are given VLAN tags on their own network interfaces to allow them to talk to anything in that VLAN but that depends on the VLANs configured on the bridge and physical switch Ideally a hypervisor should have separate interfaces for things like management, storage, clustering, etc This allows you to make the hypervisor more secure because those interfaces are in different VLANs and to access them either requires direct access or to connect via a firewall In an Enterprise equipment you can also guarantee bandwidth on sub-interfaces which helps run backups 24x7 for instance and avoids overwhelming user access

[@reuben-rt]

@@TechTutorialsDavidMcKone Thanks, this makes a lot of sense - I'm thinking about moving from esxi to proxmox, when playing around I had thought the sub-interface 'Linux VLAN' acted more like a port group on esxi, where you'd assign a VLAN ID at that stage, then add the port group to each VM. This video definitely helped on the subject!

[@003somnath]

Hello! Than you for your tutorial.. But can you post a tutorial on Routed network setup? For example: If server have 45.56.125.65/32 for main host IP and 45.30.253.0/24 (for VM IPs) and Same for IPv6 if server have 2001:4860::/48 where we can use the whole subnet for Host IP as well as VM IPs If you can do something it will be great

[@TechTutorialsDavidMcKone]

I am planning to add network related videos to the channel so hopefully that will cover what you're looking for

[@laughingpain3006]

Hi A question as to if this would still be applicable for a host with 2 or more NICs.

[@TechTutorialsDavidMcKone]

It depends on what those NICs are for You could bind them together for instance as I showed in another video and still create VLANs Or they could be kept separate and each configured for different VLANs

[@eduardopedersen6132]

Hello, one question, if I already have a cluster with three nodes, do these steps still apply or do I have to take into account something else so as not to ruin my cluster?

[@TechTutorialsDavidMcKone]

If you are changing the hypervisor NICs then you would have to be careful so I'd be inclined to power down VMs and expect outages If you have one NIC and then split it up into sub-interfaces using VLANs, there will be communication problems until all the work is finished The cluster interface may also need updating if that changes as part of the work

[@eduardopedersen6132]

@@TechTutorialsDavidMcKone Thank you for your quick answer! I understand that the VMs are not going to be able to communicate until they are configured on the same vlan or have intervlan routing. The part I'm concerned with is the cluster itself, looking at the cluster configuration, the only network information I find is the IP address... Is there any part of the configuration in the cluster where the interface is referenced?

[@krzysztofsoja5301]

I wonder: couldn't you do that initial vlan config in the GUI? I mean remove IP address from vmbr0, then add .100 to your physical interface + assign previously removed IP address to interface, and finally click "apply changes".

[@TechTutorialsDavidMcKone]

You can do, but sometimes I've found it doesn't go to plan And when it doesn't I've had to resort to getting access via a console session So I find it easier to just edit the config file as I know what the end result should look like

[@krzysztofsoja5301]

@@TechTutorialsDavidMcKone Thank You for so fast reply. Now I understand CLI is safer, more reliable option.

[@en4ble773]

Follow up question David, how can you configure sub interface BUT without IP? Just so it passes that vlan to underline?

[@TechTutorialsDavidMcKone]

You only create a sub-interface if the hypervisor itself needs access to a VLAN The VMs can access any VLAN that the bridge and switch port allow, provided this has been tagged in the VM's NIC So you might create a sub-interface for VLAN 100 because the hypervisor needs access to a NAS in VLAN 100 But if a VM needs access to VLAN 200 then it's NIC needs to be set to VLAN 200, the Linux bridge configured to support VLANs and the bridge and switch port need to allow access to VLAN 200

[@en4ble773]

@@TechTutorialsDavidMcKone thank You, had to just create sub vlan without IP and it works (traffic on that vlan is allowed). Proxmox seems so much more granular vs esxi. Love it. Thanks again for great content!

[@whats_skills]

When I do this, I list the interfaces using "ip a" command and I see that both bridges have the same mac address. For example, vmbr0: 10.0.0.0/24 and mac address 00:50:56:b1:00:0f vmbr0.15: 10.15.15.15/24 and mac address 00:50:56:b1:00:0f The host computer is plugged into a managed switch and can read VLAN 15. In my firewall, I see DHCP leases for the same mac address. One on 10.0.0.0 with 00:50:56:b1:00:0f and one on 10.15.15.15 with 00:50:56:b1:00:0f Won't this cause conflicts? Strangely, it works as intended but it does not seem right. I'm also really confused because enabling VLAN for a container like this also creates firewall bridges in/out and those are also getting assigned DHCP leases. So every time I add a new VLAN tag for a container on the same NIC like this, I'm seeing 4 additional DHCP leases created in my firewall.

[@TechTutorialsDavidMcKone]

It does look odd although I see vmbr0 doesn't have an IP address really as 10.0.0.0/24 is the network address so it shouldn't be used I'm not sure what vmbr0 is meant to represent in your network but presumably vmbr0.15 is for devices in VLAN 15 to connect directly to PVE; A hypervisor doesn't need an interface with an IP address if you just want to run VMs in a VLAN. The interface is only needed for the hypervisor itself to communicate with other devices and vice versa But if vmbr0 is for untagged traffic then the 4th octet would be better as something between 1 and 254, e.g. 10.0.0.10/24 If it's not needed, then don't assign an IP address to vmbr0 Normally the MAC address is only relevant within a subnet though so it can be duplicated between VLANs In the case of DHCP or a firewall doing Layer 2 traffic filtering it would be a problem though But a hypervisor is always better off with a static IP address anyway. If the DHCP server ever failed, especially if it's a VM, everything falls apart

[@whats_skills]

​@@TechTutorialsDavidMcKone A small update here.. It looks like this is something called IPvlan L2 where they share the same mac address and use a combination of the mac address + ip address to determine where to send the request. I didn't know that was even possible haha. But anyways thank you for the video and for the response! Cheers

[@TechTutorialsDavidMcKone]

You've got to love developers What ever happened to keeping things simple? macvlan, ipvlan l2, macvtap...brain hurts

[@Ilikeridin]

Great video but just wanted to ask a question. As Proxmox is on my main network, the IP being 192.168.0.XX. This means the Vlan tag is 0, rather than using 100 as in your video? This can’t work as you setup 2-4093 for vlan tagging. So I’d have to reconfigure my main network for this? Or are the Proxmox Vlan tags not directly associated to my networks tags? I hope I’m making sense there. Just baffled my head there.

[@TechTutorialsDavidMcKone]

The IP address and VLAN ID are independent of each other You could for instance have 192.168.0.0/24 and the VLAN ID for that is 2319 But one of the benefits of a small network is you're unlikely to exceed 255 VLANs So to make the administration and troubleshooting easier, it's really useful to align the 3rd octet with the VLAN ID E.g. when everything stops working, what are the chances you'd know the VLAN ID for 192.168.100.0/24 is 1548 as opposed to 100? Granted everything should be documented anyway but I've had dealings with entities that had none or it was outdated and now finding the VLAN ID becomes extra work

[@Ilikeridin]

@@TechTutorialsDavidMcKone thank you for confirming. That makes sense. Now another thing, does the Vlan tag in Proxmox match that of the relevant network tag, written in the router. Cheers

[@TechTutorialsDavidMcKone]

@@Ilikeridin It has to as both parties will tag traffic they send and be looking for a tag So whatever tag you decide to assign to a VLAN on a switch must be the same as one that PVE uses

[@Ilikeridin]

@@TechTutorialsDavidMcKone it may seem obvious but wasn’t sure. So for two networks I’d have to use two ethernet cables to the router

[@TechTutorialsDavidMcKone]

@@Ilikeridin Depends what you're doing and what the router can do If Proxmox VE is being plugged into a router and the router doesn't support VLANs, although PVE supports VLANs then VLANs won't work because the router won't understand the tags and can only be assigned an IP address in one network If the router does support VLAN tagging then you only need one physical cable for each device you plug into it Both sides then exchange VLAN tags which decides what VLAN the traffic belongs to It's better to plug things into a managed switch that supports VLANs, also known as 802.1Q Any device that supports VLANs then only needs one cable

[@michaelcooper5490]

How about a Proxmox Cluster? Would it be the same or would i have to add the VLANs to every host?

[@TechTutorialsDavidMcKone]

The network set up is specific to the hypervisor So how you configure the interface on one PVE server should be repeated on others This makes sure the servers have access to the same networks And by setting up VLANs for VMs the same as well, it means you can easily migrate a VM from one hypervisor to another

[@michaelcooper5490]

@@TechTutorialsDavidMcKone Thank you sir. Excellent video by the way....

[@arkojoardar2610]

Hi Guys, Could anyone help me to setup the VLAN setup in a TP-link switch (TL-SG105E), I guess I am configuring it wrong any leads would be appreciated highly

[@shetuamin]

I follow this but can't working in my homelab. My vlan is working for vm but not getting ip in pc behind Cisco sg350 switch. Can you make a video to let pass vlan through switch. Thanks.

[@TechTutorialsDavidMcKone]

I don't have that type of switch so it's not something I can cover But you'll need to setup a trunk port for the server and an access port for the PC

[@canestorb]

Hi, nice video!!! can you help me whit the Network configurations on my proxmox server?? i have 2 aditionals network cards, thanks.

[@TechTutorialsDavidMcKone]

Thanks for the feedback, I appreciate it If you have multiple NICs check out this video on bonding NICs together kzbin.info/www/bejne/pHrMoWlsh9-naqs

[@canestorb]

@@TechTutorialsDavidMcKone hi thanks for you reply… but I try and I can’t make the configuration… my virtual Pc don’t have acces to the network, can I make a Google meet an show you how I have the configuration???

[@TechTutorialsDavidMcKone]

I don't offer individual support, only basic assistance for the videos I post

[@DeanO418]

my ip range was set from my router as 192.168.1.1 as a gateway and the rest you know they are diffrent from what you set or can the vlan in the TL-SG108E I have be set to match you or will this not aline with my own net or subnet? Should i match my own subnet in the config in proxmox?

[@TechTutorialsDavidMcKone]

Stick to using the IP address range you already have Otherwise you will have to change the IP address on every device in your network

[@DeanO418]

@@TechTutorialsDavidMcKone would I call it vmbr0.100 or just vmbr0.1 then ip address starting with 192.168.1.2/24 to 192.168.1.254 do that sound correct?

[@DeanO418]

I have 4 nic on the back of my server.

[@TechTutorialsDavidMcKone]

The interface numbering relates to the VLAN being used vmbr0.1 is for VLAN 1 vmbr0.100 is for VLAN 100 In an ideal world it's great to try and match the IP addressing to the VLAN but it isn't necessary So it really depends on what VLANs you're using on the network switch But as a best practice you shouldn't use VLAN 1

[@DeanO418]

not sure whats going on now no access to proxmox now

[@timmcreynolds2734]

While I really appreciate a more thorough understanding of the vlans in proxmox, I have 5 usable IP addresses for my server and I have plans to use the "other" 4 to identify the domains that I'm putting on the server. Not having access to the switch, since this is a remote server forced a reconfigure. Would have been great if there was a caveat prior to rebooting the server.

[@TechTutorialsDavidMcKone]

It never crossed my mind as I assumed folks would watch first and attempt later I did have another comment raised about that so I've taken note

[@timmcreynolds2734]

@@TechTutorialsDavidMcKone, Thanks for the consideration. I did learn a bucket load from this video. If you need any suggestions for a future video, I could really use some instruction on setting up a Proxmox server with 5 usable public IP addresses. Of course, one is set by default, so it's what I would expect as the vmbr0. It is remote so I always have to go into the networking settings and add the IP addresses via ssh. I can reimage the server as many times as I mess things up (trust me, that's been done a LOT). I'm hoping to run a slave nameserver set up for one vm, and then set up a backup server for my hosting. And I also like testing Linux distro's, and hosting panels. Thanks again. You have a great way of explaining stuff.

[@TechTutorialsDavidMcKone]

@@timmcreynolds2734 Thanks for the feedback Not sure why you need so many IPs mind Ones assigned to PVE are either for management purposes or to split up the traffic between the nodes e.g. storage and clustering If anyone need access to a VM then they just point to the IP address of that VM and these aren't normally related to the ones assigned to PVE

[@ln663]

The moment I added the 2nd VLAN, the entire proxmox UI slowed down and unable to open the console of any VM or LXC.

[@TechTutorialsDavidMcKone]

I can't comment on performance problems as I've never experienced any But you need to make sure that the physical switch and Linux bridge in Proxmox VE are both setup to exchange VLAN tags Any device reachable via the physical switch needs to have its traffic tagged either by the switch if connected to an access port or by itself if it's connected to a trunk port like it is for Proxmox VE Similarly any VM needs to have its traffic tagged If you have a device on one VLAN trying to reach a device on another VLAN then you need something to route between the VLANs Typically this would be a Layer 3 switch or firewall but a router can do this as well

[@andrewharp3570]

Thanks for the excellent tutorial! This is exactly how I want to configure my promox. However, when I configure the interfaces exactly like you have here, I get this error. Nov 7 18:08:45 pve1 ifup[881]: ifup: missing required variable: address Nov 7 18:08:45 pve1 ifup[881]: ifup: missing required configuration variables for interface vmbr0/inet $nano /etc/network/interfaces auto lo iface lo inet loopback iface ens9 inet manual iface enp1s0f0 inet manual auto vmbr0.10 iface vmbr0.10 inet static address 10.15.10.200/24 gateway 10.15.10.1 auto vmbr0 iface vmbr0 inet static bridge-ports ens9 bridge-stp off bridge-vlan-aware yes bridge-vids 2-4092 bridge-fd 0 Seems that if I don't have "address" in vmbr0, it fails. Have you ever run into this problem?

[@andrewharp3570]

I just noticed from your notes that this line should be: iface vmbr0 inet manual instead of: iface vmbr0 inet static

[@TechTutorialsDavidMcKone]

Yeah I was just about to mention the iface vmbr0 inet static line when I saw your reply Well spotted

[@auslander1026]

Can the same be implemented with non-smart switch?

[@TechTutorialsDavidMcKone]

If the switch doesn't support VLANs (802.1Q) , then the VLAN tags have no relevance You would then have connectivity problems

[@auslander1026]

@@TechTutorialsDavidMcKone looks like tp-link TL-SG105S wont work. Was thinking to run opnsense on proxmox... Will get double NIC card then ... Thank you!

[@ryklebaron]

pvid is not Primary vlan id, but Port vlan id

[@TechTutorialsDavidMcKone]

Well spotted For some reason I looked at it being the primary VLAN ID from the perspective of a trunk port

[@kylelaker539]

Can you have 2 or three trunk port let say you have 3 proxmox server?

[@TechTutorialsDavidMcKone]

Each computer will have its own connection to a physical switch And each one can be configured as a trunk port

[@kylelaker539]

@@TechTutorialsDavidMcKone so the port you turn on your tagged only connection ,that is where proxmox one interface connected right?

[@TechTutorialsDavidMcKone]

@@kylelaker539 The idea is that each server has only one physical interface but needs to support multiple VLANs So each server will be patched into their own ports on the physical switch To support VLANs, the switch ports will need to support VLAN tagging i.e. they will be configured as trunk ports

[@TechTutorialsDavidMcKone]

@@kylelaker539 Yes, a trunk port is basically a port that accepts and sends traffic with VLAN tags

[@kylelaker539]

@@TechTutorialsDavidMcKone thanks I'm in the mode of researching how would i turn my baremetal pfsense into proxmox vm with ofcourse same network as Im using currently, The idea is like your video, I turn pfsense as trunk port and untagged traffic on every host that needed communication with the firewall I guess it's the same idea with as vm in proxmox. Thanks for the video i really appreciated it, but i have to be honest i need to rewatch my english understanding is a bit slow.

[@ierosgr]

Why let enp0s25 port to the vmbr0 and don t use it for vmbr0.100

[@TechTutorialsDavidMcKone]

Because vmbr0.100 is a virtual interface in a virtual switch vmbr0 is a Linux bridge, the virtual equivalent of a physical network switch enp0s25 in my case is the computer's physical interface If it helps, picture a physical switch and a virtual switch connected together through enp0s25, in other words enp0s25 is now like a cable really Because we've made vmbr0 VLAN aware, we can do all of the network configuration work we need on vmbr0 Now, if we want to give Proxmox access to VLAN 100, we need to create a virtual nic on vmbr0 Anyone familiar with Cisco Layer 3 switches will know these as software virtual interfaces (SVIs) If it helps, think of Proxmox as being a VM. It needs a nic to give it access to vmbr0, and this needs to be in VLAN 100 So we created a virtual nic attached to vmbr0 which is in VLAN 100, vmbr0.100 Giving actual VMs nics in VLANs is slightly different I admit, but hopefully the analogy helps

[@DAZEBYT]

got halfway through fine then he says "now you cant login to your proxmox as usual", great. Time to reinstall i suppose. Im on hetzner with a single IP and this video pretty much killed my install.

[@TechTutorialsDavidMcKone]

Thanks for the feedback I'd assumed the installer would be in control of the switch and the computer and so the order would have worked But I'll try and bear this in mind in future and mention the risks for changes like this

[@jimbrannlund4677]

Is he saying ”neutered” vlan?

[@TechTutorialsDavidMcKone]

That's an interesting way of putting it

[@jimbrannlund4677]

@@TechTutorialsDavidMcKone I honestly can't hear. 😅 And the terminology is a bit new to me, so couldn't figure it out either. What is it called?

[@TechTutorialsDavidMcKone]

@@jimbrannlund4677 I assume you're referring to the native vlan It's to do with the 802.1q protocol being used to exchange vlan information Any traffic which doesn't have a VLAN tag assigned to it is put into what's then called the native VLAN

[@jimbob12372]

Do you need nic, that is vlan aware.

[@TechTutorialsDavidMcKone]

Any network card should be OK

[@jimbob12372]

Thank you

[@famousartguymeme]

dude borked my whhole network lol

[@TechTutorialsDavidMcKone]

Ouch...Major changes can be a problem I've only had an issue when doing this via the GUI, as on one occasion the change didn't complete and it left the server without a network config Normally that method works, but it's why I stuck to the CLI method But you do have to make sure the server and switch are aligned with what does and doesn't get tagged If they don't line up then you lose connectivity and then have to fix it via a console session usually

[@famousartguymeme]

@@TechTutorialsDavidMcKone yea I gave up, I think i just need a more capable Network device such as a smart router or enterprise level, since my amazon basic routers are end of life and very limited in what they can do.

[@jeffharwood624]

Proxmox is crap. You cannot access it on first run.

[@TechTutorialsDavidMcKone]

That's unfortunate. Can you explain what the problem was? I've been running Proxmox for a while now and it hasn't had issues So I'm curious to know what went wrong

[@jeffharwood624]

@@TechTutorialsDavidMcKone Well Drac and Onboard Network controllers-fouled. Infections from ransomware does that if it penetrates the bios. This junk sells freely and without warning on ebay. After discussing it with others, first trial will be on a dual core. If successful, I will drop ESXI 7 for the expense that it creates as it is ransomware vulnerable. Eight is no different. The new supermicro have all of the upgrades. They will be water cooled. No more loud sas drives and hurricane fans. I can retire the aging R750 and 950.

[@dondarko132]

@TechTutorialsDavidMcKone, sorry for (probably) silly question, but when my proxmox is in 192.168.1.x network. Should I use? > auto vmbr0.1 iface vmbr0.1 inet static address 192.168.1.10/24 gateway 192.168.1.254 Sorry I got cofused when you said " don't use VLAN1". BTW Great content man!

[@TechTutorialsDavidMcKone]

vmbr0.1 would represent an interface for VLAN 1 And as I suggested, it's best we avoid using that Sure it would be great to match the VLAN number to the subnet as well And so I can see a reason to have vmbr0.1 represent network 192.168.1.0/24 But I've found it difficult to always match the subnet, the VLAN and the interface number So I usually just match the VLAN and interface number And since I avoid VLAN 1, I won't use a vmbr0.1

[@lnzchelo]

Hello, any tips on migrate vm proxmox => xcp-ng :)

[@TechTutorialsDavidMcKone]

Unfortunately I went in the opposite direction But I backed up configurations, created new VMs and then restored from backup Granted it is time consuming but it gave me a clean start with newer operating systems as well

[@jeffharwood624]

After many hours of investigating what went wrong with mine and others installation of 6.4-7.3 we have concluded that the iso was damaged either in the online storage or Windows attacked the OS on delivery. Most OS's when stored online degrade after time. Some we could access the backend but wouldn't upgrade. Others we could not sign in at all. I like challenges-still trying with different machines trying old processes like 127.0.0.1:8006/. I haven't messed with debian in a while. Still wanting to type sudo, but, I am still using the ESXI for now. Expensive.

[@TechTutorialsDavidMcKone]

Sounds odd as I normally have no problems with downloaded ISO files Mind you they usually get replaced every year or less with newer versions

[@jeffharwood624]

@@TechTutorialsDavidMcKone Not odd at all. Europe and Nation States have been pounding the hell out of Tech Sites. Most iso's are compressed into img files for protection. I work Cyber.