Learn Proxmox VE - Networking Fundamentals (Linux Bridges, Bonds & VLANs)

#Introduction

In episode 3 you chose the vmbr0 bridge when creating a VM. Episode 9 explains what that bridge actually is, and goes further: how to design a proper Proxmox network for multi-node infrastructure. The network is the backbone of everything you build — cluster, storage, HA, all of it depends on it.

We'll break down the Linux bridge, build network bonding for redundancy and bandwidth, and then use VLAN tagging to separate networks logically. By the end of the episode, you'll be able to read and write Proxmox network configuration with confidence.

#Linux Bridge: Proxmox's Virtual Switch

#The vmbr0 Concept

A Linux bridge is a virtual switch inside the kernel. The vmbr0 bridge in a default installation connects the host's physical NIC with all VMs and containers attached to it. Think of the bridge as a physical switch port: the physical NIC is the uplink to your switch/network, and each VM connects like an extra cable on that switch.

Physical NIC <-> vmbr0 <-> VM / CT

Without a bridge, VMs have no way out to the network. The default Proxmox configuration creates one vmbr0 bridge attached to the first NIC — enough to get started.

#Creating Multiple Bridges

Often a single network segment isn't enough. You can create additional bridges for isolation — for example, vmbr1 dedicated to management and vmbr2 dedicated to storage:

vmbr0 : VM and management network
vmbr1 : storage / Ceph network
vmbr2 : backup network

With this separation, storage and backup traffic doesn't disturb VM traffic, and the risk of one overflowing segment dragging down others is removed.

#Configuration via the CLI

Bridges are defined in the /etc/network/interfaces file. The following commands add a new bridge bound to the second NIC:

auto vmbr1
iface vmbr1 inet static
    address 10.10.0.1/24
    bridge-ports enp2s0
    bridge-stp off
    bridge-fd 0

Save, then apply it with systemctl reload networking.

#Network Bonding (Link Aggregation)

#Why Bonding?

Bonding combines two or more NICs into one logical interface for two purposes: redundancy — if one NIC or cable dies, traffic is switched to the other NIC — and bandwidth — multiple NICs can add throughput in aggregate.

#Common Bonding Modes

• balance-rr: round-robin across NICs — maximizes throughput, but can confuse switches.
• active-backup: one NIC active, the other on standby — simplest and compatible with any switch.
• 802.3ad LACP: requires a switch that supports the Link Aggregation Control Protocol — the most common enterprise mode because it combines redundancy with bandwidth aggregation.

NIC1 + NIC2 -> bond0 -> vmbr0 -> VM

#Bonding Configuration

Configuring bonding in /etc/network/interfaces with 802.3ad mode:

auto bond0
iface bond0 inet manual
    bond-slaves enp2s0 enp3s0
    bond-mode 802.3ad
    bond-miimon 100
    bond-xmit-hash-policy layer3+4

Make sure the ports on the switch are configured as an LACP trunk pointing to both of your ports. Once active, create vmbr0 on top of bond0.

#VLAN Tagging

#Layer 2 Network Isolation

VLAN allows one physical switch to carry several isolated logical networks. In Proxmox, you can make a bridge VLAN-aware: one bridge serves many VLANs at once, and each VM chooses its VLAN via a tag.

#Enabling a VLAN-Aware Bridge

Mark the bridge with bridge-vlan-aware yes:

auto vmbr0
iface vmbr0 inet manual
    bridge-ports enp1s0
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 2-4094

With this setting, you only need to enter the VLAN tag in the VM's network configuration — Proxmox automatically routes the traffic to the appropriate VLAN. This is the standard pattern for VM segregation: management VMs on VLAN 10, application VMs on VLAN 20, and database VMs on VLAN 30, all through one bridge.

#VLAN Trunk from the Switch

For tags to reach the node, the switch port facing Proxmox must be configured as a trunk forwarding all required VLANs. If you use one non-VLAN-aware bridge per segment, use access mode with a single VLAN. Pick one pattern and stay consistent.

#Closing

Episode 9 mapped out the Proxmox network: bridges as virtual switches, multiple bridges for isolation, bonding for redundancy and bandwidth, and VLAN-aware bridges for clean layer 2 segregation.

The key takeaways:

• The vmbr0 bridge is a virtual switch connecting the physical NIC to VMs.
• Separate networks with additional bridges for management, storage, and VMs.
• Bonding provides redundancy; 802.3ad LACP mode is most common in enterprise.
• A VLAN-aware bridge serves many VLANs through one uplink.
• Configuration lives in /etc/network/interfaces.
• Test access after network changes, and keep the old configuration.

In the next episode, episode 10, we will cover Software-Defined Networking and the internal firewall — creating virtual network zones and VNets from the UI, plus tiered firewall rules from the datacenter down to the VM. Your physical network is tidy; now it's time to build the virtual network on top of it!