Networking in Proxmox, bridge, VLAN and firewall
Opselis
A Linux bridge and VLANs split management, production, staging and backup. The PVE firewall runs at datacenter, host and VM. How to write vmbr, a VLAN tag and a DROP policy.
Networking in Proxmox VE is a Linux bridge (vmbr) plus optional VLANs and the built-in firewall. The bridge joins the physical NIC with guest virtual NICs. Without VLANs every VM sits in one L2 domain: staging sees the database, panel 8006 is on the same network as the store. Segmentation is in the node config (/etc/network/interfaces or SDN), not in the hope that a guest will not scan ARP.
What it is for
You use a VLAN-aware bridge when production, staging, backup and management must be separate networks. Management: only the node address and the jump host. Guests do not get a route to port 8006. Backup: a separate VLAN so a restore does not eat checkout bandwidth. The PVE firewall filters at three levels: Datacenter (default policy), Host (SSH, API), VM (service ports). That is the security-group equivalent in a public cloud.
How it works
vmbr0 with bridge-vlan-aware yes passes tagged frames. On the guest NIC you set a VLAN Tag (e.g. 10 production, 20 staging, 30 backup). The host has an address only on the management VLAN (or on a separate vmbr1). SDN (zone, VNet) repeats the same layout from the panel, instead of a hand-edited file on every node. Firewall: Datacenter, Firewall, Options. Rules: direction in/out, source, dest, a macro (SSH, HTTPS) or a port. Default input DROP, output ACCEPT. The VM inherits the policy, you add per-guest exceptions.
How to set it up
On the node in /etc/network/interfaces: vmbr0, bridge-ports eno1, bridge-vlan-aware yes, bridge-vids 10 20 30 40. Host address on vmbr0.40 (management). Restart networking in a window, with KVM or IPMI access, because a bridge mistake cuts SSH.
In the VM panel, Hardware, Network Device: VLAN Tag 10 for production. Staging: tag 20. Cloud-init supplies an IP from that subnet. The database listens on an address in the application VLAN, bind not on 0.0.0.0 toward the front guests.
Firewall: Datacenter, Firewall, Options, enable yes, input policy DROP. Rule: jump host, dst port 8006 and 22 on the nodes. On the store VM: in, 80 and 443 from the reverse-proxy VLAN, nothing from the internet. Log: Firewall, log level info, rotation. SDN: Datacenter, SDN, Zone VLAN, VNet per environment, Apply. Network layer: on-prem.