Image by: Brett Sayles
Introduction
In the evolving landscape of data centers and cloud infrastructure, implementing a secure and scalable multi-tenant network is critical for network engineers and system administrators. Proxmox Virtual Environment (VE), a robust open-source virtualization platform, offers powerful networking capabilities that can be enhanced through Software-Defined Networking (SDN) and VLAN tagging. This article presents a comprehensive, technical tutorial aimed at professionals looking to architect advanced networking within Proxmox VE. We’ll cover design trade-offs between Linux Bridges and Open vSwitch (OVS), walk through setting up SDN controllers specifically focusing on EVPN and VXLAN technologies, and demonstrate how to implement granular Proxmox firewall rules to isolate tenant traffic securely. This step-by-step guide emphasizes practical implementation and architectural best practices for multi-tenant network segmentation leveraging modern SDN paradigms.
Linux Bridges vs. Open vSwitch in Proxmox VE networking
Proxmox VE supports two primary virtualization network backends: Linux Bridges and Open vSwitch (OVS). Both serve to connect virtual machines (VMs) and containers to physical networks but differ substantially in flexibility, features, and SDN-readiness.
- Linux Bridges are simple, kernel-based Layer 2 network switches that integrate tightly with the Linux networking stack. They are easy to configure using standard Linux tools and sufficient for flat or simple tagged network environments. However, Linux Bridges lack native support for advanced SDN protocols such as VXLAN or EVPN, limiting scalability for multi-tenant overlays.
- Open vSwitch, on the other hand, is designed explicitly for virtualized environments and SDN. OVS supports advanced features including VXLAN tunneling, GRE, geneve encapsulation, and interaction with SDN controllers via OpenFlow. This makes it prime for orchestrating complex multi-tenant overlays with fine-grained traffic segmentation and dynamic path control.
From a performance perspective, both solutions rely on kernel acceleration, but OVS offers better control via programmability and APIs. For advanced use cases involving SDN, OVS is the preferred choice.
Setting up SDN controllers with EVPN and VXLAN in Proxmox VE
To architect a secure multi-tenant network with Proxmox, integrating an SDN controller that orchestrates EVPN (Ethernet VPN) and VXLAN (Virtual Extensible LAN) overlays is essential. These technologies enable scalable Layer 2 extensions over Layer 3 networks—ideal for tenant segmentation.
The process generally involves the following steps:
- Install and configure Open vSwitch: Ensure OVS is enabled on your Proxmox nodes. This involves installing the latest ‘openvswitch-switch’ package and replacing or supplementing existing Linux bridges with OVS bridges.
- Create VXLAN interfaces: Define VXLAN tunnels that encapsulate tenant traffic across physical hosts. Each VXLAN network is identified by a VXLAN Network Identifier (VNI). Example:
ovs-vsctl add-port vmbr0 vxlan0 -- set interface vxlan0 type=vxlan options:remote_ip=
options:key=100 - Deploy an EVPN controller: EVPN runs as the control plane, dynamically learning MAC addresses and distributing VXLAN mappings. Popular choices include FRRouting (FRR) with BGP EVPN support or commercial SDN controllers like OpenDaylight. Configure BGP sessions between your Proxmox nodes or OVS agents and the controller to advertise tenant segments.
- Integrate Proxmox with the SDN setup: Configure virtual machines and containers to connect via OVS ports tagged for specific VXLAN VNIs, thereby isolating tenant traffic securely across the overlay network.
Through this, you create a highly scalable, dynamic virtual network fabric that supports numerous tenants with strict traffic separation while maintaining performance.
Implementing VLAN tagging and multi-tenant segmentation
VLAN tagging remains a fundamental technique for network segmentation. When combined with VXLAN, it provides multilayered isolation:
- On the physical network: Configure your underlying switches and Proxmox OVS bridges to allow tagged VLAN trunks for tenant VLANs. Example: A VLAN 10 might represent Tenant A’s subnet.
- Inside Proxmox: Assign VMs to OVS ports tagged with the relevant VLAN ID or map VLAN tags to VXLAN VNIs. This creates an end-to-end segment extending between nodes.
In practice, you can map Tenant VLAN IDs to VXLAN VNIs to maintain VLAN isolation within tenant overlays, thus preventing VLAN ID overlap across tenants. Proxmox’s network configuration files allow VLAN tagging per interface, which can be combined with OVS’s tunnel interfaces for flexible segmentation.
| Network component | Role | Key configuration |
|---|---|---|
| Linux Bridge | Simple switch functionality for VMs/containers | bridge_ports, bridge_stp, bridge_fd |
| Open vSwitch (OVS) | Programmable virtual switch with SDN support | ovs-vsctl commands, VXLAN creation |
| VXLAN Interface | Encapsulates Layer 2 frames over Layer 3 | options:remote_ip, options:key |
| EVPN Controller | Distributes MAC/VXLAN information | BGP EVPN configuration |
Configuring Proxmox firewall rules for tenant isolation
Proxmox VE includes a highly configurable firewall module integrated at the host and VM interface levels, critical for enforcing security in a multi-tenant environment.
- Enable the Proxmox firewall: Activate the firewall globally and on individual nodes via the Proxmox web UI or command line.
- Define firewall groups: Create groups based on roles or tenant IDs to simplify rule management.
- Assign firewall rules per VM or container interface: Use rules to control inbound/outbound traffic by protocol, port, and source/destination IP addresses.
- Implement default deny policies: Block all traffic by default and explicitly allow only permitted communication paths, e.g., tenant-to-tenant isolation with no cross-tenant access.
- Leverage stateful inspection: The Proxmox firewall supports connection tracking, facilitating stateful rules to manage session-based traffic effectively.
Here is an example of a minimal firewall rule set for tenant isolation:
- Allow DHCP (UDP 67/68) and DNS (UDP/TCP 53) within tenant subnet
- Deny all traffic between different tenant VLANs/VXLANs
- Allow management traffic only from trusted admin subnets to Proxmox host
This granular control prevents unauthorized lateral movement and safeguards the virtual infrastructure.
Conclusion
Implementing advanced networking in Proxmox VE using SDN and VLAN tagging empowers network engineers and system administrators to build secure, scalable multi-tenant environments. Choosing Open vSwitch over Linux bridges is fundamental to unlock VXLAN and EVPN capabilities, allowing seamless Layer 2 overlays across multiple physical hosts. Setting up SDN controllers to manage EVPN/VXLAN tunnels dynamically enhances network flexibility and simplifies tenant isolation.
Furthermore, employing VLAN tagging integrated with VXLAN ensures multi-layer segmentation tailored to tenant requirements. The Proxmox firewall plays a vital role in enforcing security perimeters with fine-grained traffic filtering, augmenting the holistic security posture. By following this tutorial, professionals can architect a robust virtualized network fabric that supports complex deployments while maintaining uncompromised security and high performance.
