Creating a Private LAN on Proxmox VE

Introduction

This guide explains how to create a private network (LAN) for your virtual machines on Proxmox VE. This configuration allows your VMs to access the Internet via NAT (Network Address Translation) while remaining isolated on an internal private network.

Objectives

• Create an isolated private network for virtual machines
• Enable communication between VMs on the private network
• Provide Internet access via NAT
• Maintain security by isolating VMs from the main network

Prerequisites

• Proxmox VE installed and configured
• Root access to the Proxmox server
• Basic knowledge of networking and Linux

Network Architecture

Internet
    |
[vmbr0] - Public bridge (main network)
    |
[Proxmox Host]
    |
[vmbrX] - Private bridge (192.168.0.0/24)
    |
[VMs] - Virtual machines (192.168.0.10, 192.168.0.20, etc.)

Step 1: Creating the Private Bridge

Via Proxmox Web Interface

1. Log in to the Proxmox web interface
2. Navigate to Datacenter → Node name → System → Network
3. Click Create → Linux Bridge
4. In the window that opens, configure:
   • Name: vmbr1 (or any name of your choice)
   • IPv4/CIDR: 192.168.0.1/24
   • Comment: "Private bridge for VMs"
   • Leave other fields as default

Manual Configuration (Alternative)

If you prefer manual configuration, edit the network configuration file:

nano /etc/network/interfaces

Add the following configuration:

# Private bridge for VMs
auto vmbr1
iface vmbr1 inet static
    address 192.168.0.1/24
    bridge_ports none
    bridge_stp off
    bridge_fd 0
    comment "Private bridge for VMs"

Restart the network service:

systemctl restart networking

Step 2: Configuring Virtual Machines

Creating a New VM

When creating a new virtual machine:

1. In the Network tab, select the vmbr1 bridge
2. Configure the network card model according to your needs (VirtIO recommended)

Modifying an Existing VM

To modify an existing VM:

1. Select your VM in the Proxmox interface
2. Go to Hardware → Network Device
3. Modify or add a network interface
4. Select the vmbr1 bridge

Step 3: IP Configuration of Virtual Machines

Static Configuration for Linux

Edit your Linux VM's network configuration file:

# Debian/Ubuntu
nano /etc/network/interfaces

# Configuration
auto eth0
iface eth0 inet static
    address 192.168.0.10
    netmask 255.255.255.0
    gateway 192.168.0.1
    dns-nameservers 8.8.8.8 8.8.4.4

For systems using Netplan (Ubuntu 18.04+):

# /etc/netplan/01-netcfg.yaml
network:
  version: 2
  ethernets:
    eth0:
      addresses: [192.168.0.10/24]
      gateway4: 192.168.0.1
      nameservers:
        addresses: [8.8.8.8, 8.8.4.4]

Apply the configuration:

# For classic systems
systemctl restart networking

# For Netplan
netplan apply

Static Configuration for Windows

1. Open Control Panel → Network and Internet → Network Connections
2. Right-click on your network adapter → Properties
3. Select Internet Protocol Version 4 (TCP/IPv4) → Properties
4. Configure:
   • IP Address: 192.168.0.20
   • Subnet Mask: 255.255.255.0
   • Default Gateway: 192.168.0.1
   • Preferred DNS Server: 8.8.8.8
   • Alternate DNS Server: 8.8.4.4

Step 4: NAT Configuration

Enabling IP Routing

Edit the system configuration file:

nano /etc/sysctl.conf

Add or uncomment the line:

net.ipv4.ip_forward = 1

Enable routing immediately:

sysctl -p

iptables Configuration

Add the NAT rule to allow Internet access:

iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o vmbr0 -j MASQUERADE

Persistent iptables Rules

Install iptables-persistent if not already installed:

apt update
apt install iptables-persistent

Save the rules:

netfilter-persistent save

For a more robust configuration, create a startup script:

nano /etc/systemd/system/proxmox-nat.service

[Unit]
Description=Proxmox NAT Rules
After=network.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o vmbr0 -j MASQUERADE
ExecStop=/sbin/iptables -t nat -D POSTROUTING -s 192.168.0.0/24 -o vmbr0 -j MASQUERADE

[Install]
WantedBy=multi-user.target

Enable the service:

systemctl enable proxmox-nat.service
systemctl start proxmox-nat.service

Step 5: Testing and Verification

Connectivity Tests

From the Proxmox host, test connectivity to your VMs:

# Ping test to a VM
ping 192.168.0.10
ping 192.168.0.20

Tests from VMs

From your VMs, test:

# Test to the gateway
ping 192.168.0.1

# Test to Internet
ping 8.8.8.8
ping google.com

# DNS resolution test
nslookup google.com

Troubleshooting

If connectivity doesn't work:

1. Check bridge configuration:

   ip addr show vmbr1
   

2. Check iptables rules:

   iptables -t nat -L POSTROUTING -v
   

3. Check IP routing:

   cat /proc/sys/net/ipv4/ip_forward
   

4. Check routes on VMs:

   route -n
   # or
   ip route show
   

Advanced Configuration

DHCP Server (Optional)

To automate IP address assignment, you can install a DHCP server:

apt install isc-dhcp-server

Configure /etc/dhcp/dhcpd.conf:

subnet 192.168.0.0 netmask 255.255.255.0 {
    range 192.168.0.100 192.168.0.200;
    option routers 192.168.0.1;
    option domain-name-servers 8.8.8.8, 8.8.4.4;
    option domain-name "lan.local";
}

Configure the interface in /etc/default/isc-dhcp-server:

INTERFACESv4="vmbr1"

Start and enable the service:

systemctl enable isc-dhcp-server
systemctl start isc-dhcp-server

Advanced Firewall Rules

For enhanced security, you can add specific rules:

# Allow only certain ports
iptables -A FORWARD -i vmbr1 -o vmbr0 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i vmbr1 -o vmbr0 -p tcp --dport 443 -j ACCEPT

# Block access to Proxmox admin interface
iptables -A FORWARD -i vmbr1 -d [PROXMOX_IP] -p tcp --dport 8006 -j DROP

# Allow established and related connections
iptables -A FORWARD -i vmbr0 -o vmbr1 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Default deny policy for security
iptables -A FORWARD -i vmbr1 -o vmbr0 -j DROP

Network Isolation Between VMs

To isolate specific VMs from each other:

# Block communication between specific IP ranges
iptables -A FORWARD -s 192.168.0.10 -d 192.168.0.20 -j DROP
iptables -A FORWARD -s 192.168.0.20 -d 192.168.0.10 -j DROP

Best Practices

1. Security: Use private IP addresses (RFC 1918)
2. Performance: Use VirtIO for network interfaces
3. Monitoring: Monitor network traffic
4. Documentation: Document your network configurations
5. Backup: Backup your iptables configurations
6. Updates: Keep your Proxmox system updated
7. Resource Planning: Plan IP address allocation carefully

Common Troubleshooting

Issue: No Internet access from VMs

Solutions:

• Check that ip_forward is enabled
• Verify NAT iptables rules
• Check DNS configuration on VMs
• Verify gateway configuration on VMs

Issue: VMs cannot communicate with each other

Solutions:

• Ensure VMs are on the same bridge
• Check firewall settings on VMs
• Verify bridge configuration
• Check for blocking iptables rules

Issue: Configuration lost after reboot

Solutions:

• Use netfilter-persistent for iptables rules
• Create a systemd service to automate configuration
• Ensure modifications in /etc/network/interfaces are correct
• Check that services are enabled to start at boot

Issue: DHCP not working

Solutions:

• Check DHCP server status: systemctl status isc-dhcp-server
• Verify DHCP configuration file syntax
• Check DHCP server logs: journalctl -u isc-dhcp-server
• Ensure the correct interface is specified

Issue: Slow network performance

Solutions:

• Use VirtIO network drivers
• Check for network congestion
• Verify MTU settings
• Monitor CPU usage on the host

Security Considerations

Network Segmentation

Consider creating multiple private networks for different purposes:

# Development network
auto vmbr2
iface vmbr2 inet static
    address 192.168.1.1/24
    bridge_ports none
    bridge_stp off
    bridge_fd 0

# Production network
auto vmbr3
iface vmbr3 inet static
    address 192.168.2.1/24
    bridge_ports none
    bridge_stp off
    bridge_fd 0

Access Control Lists

Implement strict access control:

# Allow only specific protocols and ports
iptables -A FORWARD -i vmbr1 -p tcp --dport 22 -j ACCEPT  # SSH
iptables -A FORWARD -i vmbr1 -p tcp --dport 80 -j ACCEPT  # HTTP
iptables -A FORWARD -i vmbr1 -p tcp --dport 443 -j ACCEPT # HTTPS
iptables -A FORWARD -i vmbr1 -p udp --dport 53 -j ACCEPT  # DNS
iptables -A FORWARD -i vmbr1 -j DROP                      # Drop all other traffic

Monitoring and Logging

Enable logging for security monitoring:

# Log dropped packets
iptables -A FORWARD -j LOG --log-prefix "FORWARD-DROPPED: "

# Monitor with tcpdump
tcpdump -i vmbr1

# Check logs
tail -f /var/log/syslog | grep FORWARD-DROPPED

Performance Optimization

Network Tuning

Optimize network performance:

# Increase network buffer sizes
echo 'net.core.rmem_max = 134217728' >> /etc/sysctl.conf
echo 'net.core.wmem_max = 134217728' >> /etc/sysctl.conf
echo 'net.ipv4.tcp_rmem = 4096 87380 134217728' >> /etc/sysctl.conf
echo 'net.ipv4.tcp_wmem = 4096 65536 134217728' >> /etc/sysctl.conf

# Apply changes
sysctl -p

VM Configuration

Optimize VM network settings:

1. Use VirtIO network adapter
2. Enable multiqueue if supported
3. Set appropriate CPU allocation
4. Configure proper memory allocation

Backup and Recovery

Configuration Backup

Create a backup script:

#!/bin/bash
# backup-network-config.sh

BACKUP_DIR="/root/network-backups/$(date +%Y%m%d-%H%M%S)"
mkdir -p "$BACKUP_DIR"

# Backup network configuration
cp /etc/network/interfaces "$BACKUP_DIR/"
cp /etc/sysctl.conf "$BACKUP_DIR/"

# Backup iptables rules
iptables-save > "$BACKUP_DIR/iptables-rules"

# Backup DHCP configuration if exists
if [ -f /etc/dhcp/dhcpd.conf ]; then
    cp /etc/dhcp/dhcpd.conf "$BACKUP_DIR/"
fi

echo "Network configuration backed up to $BACKUP_DIR"

Recovery Procedure

In case of configuration loss:

# Restore network interfaces
cp backup/interfaces /etc/network/interfaces

# Restore sysctl configuration
cp backup/sysctl.conf /etc/sysctl.conf
sysctl -p

# Restore iptables rules
iptables-restore < backup/iptables-rules

# Restart services
systemctl restart networking
systemctl restart isc-dhcp-server  # if DHCP is used

Conclusion

With this configuration, you now have a functional private network under Proxmox VE. Your virtual machines can communicate with each other and access the Internet via NAT while remaining isolated from the main network.

This solution is ideal for:

• Development and testing environments
• Isolation of sensitive services
• Learning laboratories
• Internal service deployments
• Multi-tenant environments
• Security-focused deployments

Feel free to adapt this configuration to your specific needs and implement additional security measures according to your environment. Regular monitoring and maintenance will ensure optimal performance and security of your private network infrastructure.

Additional Resources

• Proxmox VE Network Configuration
• Linux Bridge Configuration
• iptables Tutorial
• Network Troubleshooting Guide

Support and Community

For additional help and community support:

• Proxmox Community Forum
• Linux networking communities
• Stack Overflow for specific technical issues
• Official Proxmox documentation