Proxmox networking guidance

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.
C

Cape

Member
Oct 28, 2015
36
6
8
Hey,
I'm setting up Proxmox for the first time, after being a long-time ESXi user, and am somewhat confused on how to best configure networking.
I've decided to go with open vSwitch, and what I think I want to do is this (certainly up for debate if there's better ideas):

eno1/vmbr1 - Management net, connected to (untagged) VLAN 255
* mgmt1 - OVS_IntPort with proxmox management IP
* Any VMs which expose management interfaces will have a vNIC here
eno2/vmbr2 - WAN net, connected to (untagged) VLAN 1000
* VMs which expose directly to WAN. Initially will only be pfsense, but there are plans that could include others.
eno3/vmbr3 - "Internal" net, connected to trunked VLAN port for client lan, etc
* Most VMs
eno4/vmbr4 - Storage?
* If/when there are multiple nodes this will be used for storage

I'm hitting a road block pretty much right away when setting up pfsense, initially passing it NICs on the WAN and management bridges. Setting an IP on the management interface, I'm unable to reach it from other machines. The PVE host can reach it, though.
So, two questions:
1. Am I doing it wrong? :) Basically, this is translated as best as I could from how I'd do an ESXi setup, and it might not make sense here.
2. If not conceptually wrong, why can't I reach my VM? I tried enabling ip forwarding/routing on the PVE host, which didn't help (although I would expect this not to be needed, OVS should handle that, right?
 
MiniKnight

MiniKnight

Well-Known Member
Mar 30, 2012
3,072
973
113
NYC
I ***think*** you still need to do E1000 NICs on the pfSense NICs with Proxmox. FreeBSD is well...…..

If that isn't it, then there is some other little setting like that. I can't remember exactly, but I think it's the E1000 NIC issue why you can't get to the pfSense NIC.
 
C

Cape

Member
Oct 28, 2015
36
6
8
Nope, E1000 does not work either :( Thanks for the suggestion though! Any idea what other setting could be relevant? Basically running with just standard everything on that VM right now.
 
C

Cape

Member
Oct 28, 2015
36
6
8
Ah, cool. I'll try that tonight!
But this is causing packet loss? I seem to be unable to even route to the VM, though. Should it be that severe packet loss?
 
C

Cape

Member
Oct 28, 2015
36
6
8
Did some more digging now. I cannot access the ui, so I don't really have a way to disable offload...
I can however do tcpdump via the console. So I have had tcpdumps on my laptop, the proxmox host, and on the pfsense VM. I can see ping/curl etc coming in to pfsense (ie showing up in all three tcpdumps), but pfsense doesn't seem to respond. Even on the pfsense box, I don't see any replies in the dump.
Outbound access from pfSense works, though...

Could it be so simple as pf installing with everything blocked for some reason? I've tried resetting interfaces etc without effect
 
C

Cape

Member
Oct 28, 2015
36
6
8
This is beginning to look the case. Started up a Linux VM and was able to reach both in and out... Will try an older pfsense image and see if there's a problem with the latest
 
C

Cape

Member
Oct 28, 2015
36
6
8
*Finally* found the problem... My own doing, of course.
Since I'm in the migration process from ESXi, I've set up proxmox side-by-side with my old lab, which still has the pfsense acting as router/gateway for the mangement network. When setting up a new pfSense install, it seems it expects it to be the gateway of all networks (fair enough), and thus doesn't add a gateway on the LAN/management interface. So thus it can't reply to my pings etc which comes from a different subnet...

Facepalms have been had. Sorry for wasting your time, and appreciate the suggestions!
 
  • Like
Reactions: vudu
V

vudu

Member
Dec 30, 2017
63
22
8
63
Glad you got it sorted and sorry I hadn't been keeping a closer eye on this. The gateway issues you mentioned have bit me many times when I have built a PFSense box on our LAN and then moved it to a customer LAN with different subnet.
 
C

Cape

Member
Oct 28, 2015
36
6
8
Btw, I did have to go back an disable the offload when I finally got everything working. Speed tests with ~1 Mbps instead of 800+ Mbps...
So thanks for pointing that out in advance :)
 
  • Like
Reactions: vudu
You must log in or register to reply here.
Top Bottom