Proxmox VE networking: Linux bridges (vmbr0) and VLANs

A Linux bridge works like a software network switch inside the host. Physical network cards and the virtual network cards of guests plug into it. The installer creates one bridge, vmbr0, connected to the first physical NIC, and puts the host’s management IP on it. Guests attached to vmbr0 appear on the physical network with their own MAC addresses.

The default configuration

Network configuration lives in /etc/network/interfaces. A typical default looks like this (interface names differ per server):

auto lo
iface lo inet loopback

iface eno1 inet manual

auto vmbr0
iface vmbr0 inet static
        address 192.0.2.10/24
        gateway 192.0.2.1
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0

The physical NIC eno1 has no address of its own; it is just a port of the bridge. The IP address belongs to vmbr0.

How changes are applied

When you edit networking in the web UI (Node → System → Network), Proxmox VE writes to /etc/network/interfaces.new first. Nothing changes until you click Apply Configuration, which moves the file into place and reloads the network live using ifupdown2 (the default since Proxmox VE 7). If you edit /etc/network/interfaces by hand, apply it with:

ifreload -a

Warning: a wrong address, gateway or bridge port can cut off your SSH and web access to the node. Make changes from a console you can reach out of band (IPMI, iLO, a physical screen) or at least keep a second session open, and double-check the file before applying.

VLANs for guests: the VLAN-aware bridge

The simplest way to put guests in different VLANs is to make the bridge VLAN aware. The physical switch port must be a trunk that carries those VLANs. Then each guest NIC gets a VLAN tag, and the bridge handles the tagging.

auto vmbr0
iface vmbr0 inet manual
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 2-4094

auto vmbr0.5
iface vmbr0.5 inet static
        address 10.0.0.2/24
        gateway 10.0.0.1

In this example the host’s own management address sits in VLAN 5 on vmbr0.5. Attach guests by setting tag= on their network device:

qm set 110 --net0 virtio,bridge=vmbr0,tag=20
pct set 200 --net0 name=eth0,bridge=vmbr0,tag=30,ip=dhcp

The other option, the “traditional” VLAN setup, creates a separate VLAN device and bridge per VLAN (for example eno1.5 and vmbr0v5). It works, but VLAN-aware bridges are easier to manage when you have many VLANs.

More bridges and bonds

• Create additional bridges (vmbr1, vmbr2, …) to separate networks, for example a storage or internal-only network. A bridge without any bridge-ports is an isolated network between guests on that host only.
• A bond (bond0) combines several NICs for redundancy or throughput and can then be used as the bridge port.
• Bridge names may be any alphanumeric string up to 10 characters that starts with a letter; vmbrN is just the convention.

Cluster traffic

If you build a cluster, keep Corosync cluster traffic away from busy networks such as storage or backup traffic. Corosync needs low latency more than bandwidth, and the documentation recommends a dedicated NIC for it.

Official documentation

• Host System Administration: Network Configuration