# ThinkStation Proxmox VE 8.x Configuration Guide ## Uplink Transit & Isolated Workload Bridge Setup This guide details how to configure network interfaces, kernel routing, and remote management on the ThinkStation running Proxmox VE 8.x, ensuring that internal VMs/LXCs on `192.168.45.0/24` maintain seamless internet access while remaining completely isolated from the upstream LAN. --- ## 1. Network Architecture Overview On the Proxmox host, we define two distinct Linux network bridges: 1. **`vmbr0` (Uplink Transit Bridge)**: - Contains the physical Ethernet NIC (`eno1`). - Assigned static IP `172.16.100.2/24` with default gateway `172.16.100.1` (the T490). - Serves as the Proxmox Web GUI management interface (`https://172.16.100.2:8006`). 2. **`vmbr1` (Isolated Workload Bridge)**: - Contains **no physical ports** (`bridge-ports none`). - Assigned static IP `192.168.45.1/24` (acts as the default gateway for all guest VMs/LXCs). - Keeps VM broadcast traffic strictly inside the hypervisor kernel. --- ## 2. Proxmox VE Network Interfaces Configuration Backup and update `/etc/network/interfaces`: ```bash sudo cp /etc/network/interfaces /etc/network/interfaces.bak ``` Edit `/etc/network/interfaces`: ```ini # /etc/network/interfaces # ============================================================================== # PROXMOX VE 8.x - DUAL BRIDGE ROUTED CONFIGURATION # ============================================================================== auto lo iface lo inet loopback # Physical Gigabit Interface connected to ThinkPad T490 iface eno1 inet manual # ------------------------------------------------------------------------------ # vmbr0: Transit Uplink to ThinkPad T490 Edge Gateway # ------------------------------------------------------------------------------ auto vmbr0 iface vmbr0 inet static address 172.16.100.2/24 gateway 172.16.100.1 bridge-ports eno1 bridge-stp off bridge-fd 0 dns-nameservers 1.1.1.1 9.9.9.9 # ------------------------------------------------------------------------------ # vmbr1: Isolated Workload Bridge (Workload Subnet: 192.168.45.0/24) # ------------------------------------------------------------------------------ auto vmbr1 iface vmbr1 inet static address 192.168.45.1/24 bridge-ports none bridge-stp off bridge-fd 0 ``` Apply the network configuration: ```bash ifreload -a ``` Verify interface states: ```bash ip addr show vmbr0 ip addr show vmbr1 ip route show ``` Expected route table output: ``` default via 172.16.100.1 dev vmbr0 proto kernel onlink 172.16.100.0/24 dev vmbr0 proto kernel scope link src 172.16.100.2 192.168.45.0/24 dev vmbr1 proto kernel scope link src 192.168.45.1 ``` --- ## 3. Kernel IPv4 Forwarding Activation Enable kernel packet routing between `vmbr1` and `vmbr0` without local NAT: Create `/etc/sysctl.d/99-pve-routing.conf`: ```ini net.ipv4.ip_forward = 1 net.ipv6.conf.all.forwarding = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.vmbr0.send_redirects = 0 net.ipv4.conf.vmbr1.send_redirects = 0 ``` Apply immediately: ```bash sysctl -p /etc/sysctl.d/99-pve-routing.conf ``` --- ## 4. Tailscale Subnet Router Configuration To manage the Proxmox hypervisor and access all internal `192.168.45.0/24` workloads remotely without port forwarding: ### 4.1 Install Tailscale on Proxmox VE ```bash curl -fsSL https://tailscale.com/install.sh | sh ``` ### 4.2 Start Subnet Router ```bash sudo tailscale up --advertise-routes=192.168.45.0/24 --advertise-tags=tag:homelab-core --ssh --hostname=pve-thinkstation ``` ### 4.3 Approve Subnet Routes in Tailscale Console 1. Navigate to the **Tailscale Admin Console** (`https://login.tailscale.com/admin/machines`). 2. Locate `pve-thinkstation`. 3. Click the three dots `...` -> **Edit route settings...**. 4. Check the box for `192.168.45.0/24` and approve. --- ## 5. VM / Container Provisioning Automation Script Update your provisioning script to attach new VMs to `vmbr1` and automatically set the static IP based on the resource ID (`192.168.45.X`). Save as `/usr/local/bin/create-homelab-vm.sh`: ```bash #!/usr/bin/env bash # ============================================================================== # /usr/local/bin/create-homelab-vm.sh # Cloud-Init VM Provisioning with ID-to-IP Dynamic Assignment # ============================================================================== set -euo pipefail if [ "$#" -lt 2 ]; then echo "Usage: $0 [CORES] [RAM_MB] [DISK_GB]" echo "Example: $0 105 web-server-01 4 4096 32" exit 1 fi VM_ID="$1" VM_NAME="$2" CORES="${3:-2}" RAM_MB="${4:-2048}" DISK_GB="${5:-20}" TARGET_IP="192.168.45.${VM_ID}" GATEWAY_IP="192.168.45.1" DNS_SERVERS="1.1.1.1 9.9.9.9" STORAGE_POOL="local-lvm" CLOUD_IMAGE_PATH="/var/lib/vz/template/iso/noble-server-cloudimg-amd64.img" echo "==> Provisioning VM ${VM_ID} (${VM_NAME})..." echo "==> Assigned IP: ${TARGET_IP}/24 via Gateway: ${GATEWAY_IP}" # 1. Create VM Shell attached to isolated bridge vmbr1 qm create "$VM_ID" \ --name "$VM_NAME" \ --memory "$RAM_MB" \ --cores "$CORES" \ --cpu host \ --net0 virtio,bridge=vmbr1 # 2. Import OS Disk from Cloud-Init image qm set "$VM_ID" --scsihw virtio-scsi-pci --scsi0 "${STORAGE_POOL}:0,import-from=${CLOUD_IMAGE_PATH}" # 3. Add Cloud-Init Drive & Display Settings qm set "$VM_ID" --ide2 "${STORAGE_POOL}:cloudinit" --boot order=scsi0 --serial0 socket --vga serial0 # 4. Resize Root Disk qm resize "$VM_ID" scsi0 "${DISK_GB}G" # 5. Configure Cloud-Init Networking qm set "$VM_ID" \ --ipconfig0 "ip=${TARGET_IP}/24,gw=${GATEWAY_IP}" \ --nameserver "$DNS_SERVERS" echo "==> Starting VM ${VM_ID}..." qm start "$VM_ID" echo "==> VM ${VM_ID} successfully created and booted at ${TARGET_IP}." ``` Make executable: ```bash chmod +x /usr/local/bin/create-homelab-vm.sh ``` --- ## 6. Proxmox Host Verification From the Proxmox shell, test connectivity: ```bash # 1. Ping the T490 Transit Gateway ping -c 3 172.16.100.1 # 2. Test External Internet Connectivity ping -c 3 1.1.1.1 # 3. Test DNS Resolution host -t A cloudflare.com 1.1.1.1 ```