In this article we show you how to create a private and virtual network bridge on Proxmox with NAT configured. In Proxmox virtualization infrastructure, network configuration can be done either via the CLI (manually editing network configuration files), or from an intuitive graphical user interface. Either method can be used, but a choice may depend on your Linux administration expertise.
One advantage of modifying network configurations from GUI is that Proxmox VE does not write changes directly to /etc/network/interfaces. Instead, it will use a temporary file called /etc/network/interfaces.new, which allows many related changes at once. It also helps to ensure the network changes are correct before committing to /etc/network/interfaces , as a wrong network configuration may render a node inaccessible.
Create Virtual Network Bridge on Proxmox With NAT
For CLI method you’ll edit /etc/network/interfaces configuration file directly.
sudo vim /etc/network/interfacesI’ll create a virtual network bridge based on below network parameters:
- Network: 192.168.50.0
- Network mask: 255.255.255.0
- Proxmox host IP: 192.168.50.1
Print current active network interfaces on the server:
$ sudo ip -f inet a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
inet 192.168.58.236/26 brd 195.201.58.255 scope global enp4s0
valid_lft forever preferred_lft forever
I’ll create a virtual bridge named vmbr1
auto vmbr1
iface vmbr1 inet static
address 192.168.50.1
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0Notice there is no physical interface linked to the bridge (bridge_ports none).
Configure NAT (Masquerading)
Masquerading allows your virtual machines in a private network created to access the external networks by using the host IP address for outgoing traffic. Each outgoing packet is rewritten by iptables to appear as originating from the host, and responses are rewritten accordingly to be routed to the original sender.
I’ll modify above network configurations to add routing for internet connectivity. Since my primary interface enp4s0 is connected to physical switch and has internet connectivity, we’ll route traffic coming from vmbr1 through it.
auto vmbr1
iface vmbr1 inet static
address 192.168.50.1
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '192.168.50.0/24' -o enp4s0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '192.168.50.0/24' -o enp4s0 -j MASQUERADENote that enp4s0 can be replaced with a VLAN interface or another Linux bridge. iptables provides the masquerading feature that allow instances on the private virtual network to access the internet.
Bring up the bridge interface
Validate your network configurations are correct by manually bringing up the bridge interface
$ sudo ifup vmbr1
Waiting for vmbr1 to get ready (MAXWAIT is 2 seconds).Check bridge IP information:
$ ip address show dev vmbr1
3: vmbr1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 16:cf:7e:23:de:1e brd ff:ff:ff:ff:ff:ff
inet 192.168.50.1/24 brd 192.168.50.255 scope global vmbr1
valid_lft forever preferred_lft forever
inet6 fe80::14cf:7eff:fe23:de1e/64 scope link
valid_lft forever preferred_lft foreverFrom the output it can be confirmed the IP address on the vmbr1 is correct.
You should be able to restart networking service without any failures:
sudo systemctl restart networkingConfirm status is active:
$ systemctl status networking.service
● networking.service - Raise network interfaces
Loaded: loaded (/lib/systemd/system/networking.service; enabled; vendor preset: enabled)
Active: active (exited) since Fri 2021-05-07 19:27:34 CEST; 29s ago
Docs: man:interfaces(5)
Process: 27355 ExecStart=/sbin/ifup -a --read-environment (code=exited, status=0/SUCCESS)
Main PID: 27355 (code=exited, status=0/SUCCESS)
May 07 19:27:29 proxmox systemd[1]: Starting Raise network interfaces...
May 07 19:27:34 proxmox ifup[27355]: Waiting for DAD... Done
May 07 19:27:34 proxmox ifup[27355]: Waiting for vmbr1 to get ready (MAXWAIT is 2 seconds).
May 07 19:27:34 proxmox systemd[1]: Started Raise network interfaces.Once you create a Virtual machine on the bridge created, it will behave as if it is directly connected to the physical network. The network, in turn, sees each virtual machine as having its own MAC, even though there is only one network cable connecting all of these VMs to the network.
Our next articles will cover more ares on Proxmox server administration. In the meantime, checkout other articles we have on Virtualization:
