Proxmox Network Bridge & VLAN Configuration

Every Proxmox VM connects to a Linux bridge on the host. Understanding the Proxmox network bridge model, plus VLANs and NAT, lets you build anything from a home lab to a hosted server with a routed IP block.

Before you start

Console or IPMI access: a network mistake can cut your SSH and web UI.
Your IP details: host IP, gateway, and any extra IPs or blocks from your provider.

The default Proxmox network bridge

The installer creates vmbr0 on your main NIC and puts the host IP on it. VMs attached to vmbr0 appear on the same network as the host, like extra machines plugged into the same switch. Configuration lives in /etc/network/interfaces:

auto vmbr0
iface vmbr0 inet static
    address 203.0.113.10/24
    gateway 203.0.113.1
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0

Edit networking in the web UI under Node → System → Network, then click Apply Configuration.

VLAN-aware bridges

Edit vmbr0 and tick VLAN aware.
Make sure the switch port is a trunk carrying those VLANs.
On each VM's network device, set the VLAN Tag (for example 20).

Private NAT network for VMs

When you have only one public IP, create a second bridge without physical ports and masquerade it:

auto vmbr1
iface vmbr1 inet static
    address 10.10.10.1/24
    bridge-ports none
    bridge-stp off
    bridge-fd 0
    post-up echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o vmbr0 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s 10.10.10.0/24 -o vmbr0 -j MASQUERADE

Give VMs addresses in 10.10.10.0/24 with gateway 10.10.10.1. Forward ports with DNAT rules if a VM must be reachable.

Routed setups at hosting providers

Many data centres only accept traffic from the server's registered MAC address, so bridged VMs with their own MACs are dropped. Options:

Ask the provider for virtual MACs for extra IPs and set them on the VM NICs.
Use a routed setup: the host routes the extra IP block to vmbr1 and VMs use the host as gateway.

Warning: Bridging unknown MACs onto a provider network can get your port shut down for abuse. Check your provider's rules first.

Troubleshooting

Lost access after Apply: fix /etc/network/interfaces from the console and run ifreload -a.
VM has no internet on NAT: check IP forwarding and the MASQUERADE rule with iptables -t nat -L -n.
VLAN traffic missing: the switch port is not tagged for that VLAN.

Frequently asked questions

Can I bond two NICs?

Yes. Create a Linux bond in the web UI and use it as the bridge port.

Do I need Open vSwitch?

Linux bridges cover most needs; OVS is optional for advanced setups.

How do I give a VM IPv6?

Route or bridge your IPv6 block the same way and configure it inside the VM (IPv6 setup).

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket