X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=pve-network.adoc;h=0e94f288ce5a59aad360a9100a4d9a7d18dfbf2d;hb=00dc358b517ae6653cbdfb72e8a82232681af2d5;hp=9178cce5d5c87d18288ea1ba4e240c3e0b8b188e;hpb=33349b9fad0c70b93dfaed5d685ae99fa8e0edde;p=pve-docs.git diff --git a/pve-network.adoc b/pve-network.adoc index 9178cce..0e94f28 100644 --- a/pve-network.adoc +++ b/pve-network.adoc @@ -5,15 +5,30 @@ ifdef::wiki[] :pve-toplevel: endif::wiki[] -Network configuration can be done either via the GUI, or by manually -editing the file `/etc/network/interfaces`, which contains the -whole network configuration. The `interfaces(5)` manual page contains the -complete format description. All {pve} tools try hard to keep direct -user modifications, but using the GUI is still preferable, because it +{pve} is using the Linux network stack. This provides a lot of flexibility on +how to set up the network on the {pve} nodes. The configuration can be done +either via the GUI, or by manually editing the file `/etc/network/interfaces`, +which contains the whole network configuration. The `interfaces(5)` manual +page contains the complete format description. All {pve} tools try hard to keep +direct user modifications, but using the GUI is still preferable, because it protects you from errors. -Once the network is configured, you can use the Debian traditional tools `ifup` -and `ifdown` commands to bring interfaces up and down. +A 'vmbr' interface is needed to connect guests to the underlying physical +network. They are a Linux bridge which can be thought of as a virtual switch +to which the guests and physical interfaces are connected to. This section +provides some examples on how the network can be set up to accomodate different +use cases like redundancy with a xref:sysadmin_network_bond['bond'], +xref:sysadmin_network_vlan['vlans'] or +xref:sysadmin_network_routed['routed'] and +xref:sysadmin_network_masquerading['NAT'] setups. + +The xref:chapter_pvesdn[Software Defined Network] is an option for more complex +virtual networks in {pve} clusters. + +WARNING: It's discouraged to use the traditional Debian tools `ifup` and `ifdown` +if unsure, as they have some pitfalls like interupting all guest traffic on +`ifdown vmbrX` but not reconnecting those guest again when doing `ifup` on the +same bridge later. Apply Network Changes ~~~~~~~~~~~~~~~~~~~~~ @@ -24,37 +39,29 @@ can do many related changes at once. This also allows to ensure your changes are correct before applying, as a wrong network configuration may render a node inaccessible. -Reboot Node to apply -^^^^^^^^^^^^^^^^^^^^ - -With the default installed `ifupdown` network managing package you need to -reboot to commit any pending network changes. Most of the time, the basic {pve} -network setup is stable and does not change often, so rebooting should not be -required often. - -Reload Network with ifupdown2 -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -With the optional `ifupdown2` network managing package you also can reload the -network configuration live, without requiring a reboot. +Live-Reload Network with ifupdown2 +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Since {pve} 6.1 you can apply pending network changes over the web-interface, -using the 'Apply Configuration' button in the 'Network' panel of a node. +With the recommended 'ifupdown2' package (default for new installations since +{pve} 7.0), it is possible to apply network configuration changes without a +reboot. If you change the network configuration via the GUI, you can click the +'Apply Configuration' button. This will move changes from the staging +`interfaces.new` file to `/etc/network/interfaces` and apply them live. -To install 'ifupdown2' ensure you have the latest {pve} updates installed, then +If you made manual changes directly to the `/etc/network/interfaces` file, you +can apply them by running `ifreload -a` -WARNING: installing 'ifupdown2' will remove 'ifupdown', but as the removal -scripts of 'ifupdown' before version '0.8.35+pve1' have a issue where network -is fully stopped on removal footnote:[Introduced with Debian Buster: -https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=945877] you *must* ensure -that you have a up to date 'ifupdown' package version. +NOTE: If you installed {pve} on top of Debian, or upgraded to {pve} 7.0 from an +older {pve} installation, make sure 'ifupdown2' is installed: `apt install +ifupdown2` -For the installation itself you can then simply do: - - apt install ifupdown2 +Reboot Node to Apply +^^^^^^^^^^^^^^^^^^^^ -With that you're all set. You can also switch back to the 'ifupdown' variant at -any time, if you run into issues. +Another way to apply a new network configuration is to reboot the node. +In that case the systemd service `pvenetcommit` will activate the staging +`interfaces.new` file before the `networking` service will apply that +configuration. Naming Conventions ~~~~~~~~~~~~~~~~~~ @@ -167,6 +174,7 @@ physical network. The network, in turn, sees each virtual machine as having its own MAC, even though there is only one network cable connecting all of these VMs to the network. +[[sysadmin_network_routed]] Routed Configuration ~~~~~~~~~~~~~~~~~~~~ @@ -185,30 +193,31 @@ address. [thumbnail="default-network-setup-routed.svg"] A common scenario is that you have a public IP (assume `198.51.100.5` for this example), and an additional IP block for your VMs -(`203.0.113.16/29`). We recommend the following setup for such +(`203.0.113.16/28`). We recommend the following setup for such situations: ---- auto lo iface lo inet loopback -auto eno1 -iface eno1 inet static - address 198.51.100.5/24 +auto eno0 +iface eno0 inet static + address 198.51.100.5/29 gateway 198.51.100.1 post-up echo 1 > /proc/sys/net/ipv4/ip_forward - post-up echo 1 > /proc/sys/net/ipv4/conf/eno1/proxy_arp + post-up echo 1 > /proc/sys/net/ipv4/conf/eno0/proxy_arp auto vmbr0 iface vmbr0 inet static - address 203.0.113.17/29 + address 203.0.113.17/28 bridge-ports none bridge-stp off bridge-fd 0 ---- +[[sysadmin_network_masquerading]] Masquerading (NAT) with `iptables` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -258,10 +267,10 @@ https://commons.wikimedia.org/wiki/File:Netfilter-packet-flow.svg[Netfilter Pack https://lwn.net/Articles/370152/[Patch on netdev-list introducing conntrack zones] -https://blog.lobraun.de/2019/05/19/prox/[Blog post with a good explanation by using TRACE in the raw table] - +https://web.archive.org/web/20220610151210/https://blog.lobraun.de/2019/05/19/prox/[Blog post with a good explanation by using TRACE in the raw table] +[[sysadmin_network_bond]] Linux Bond ~~~~~~~~~~ @@ -399,6 +408,7 @@ iface vmbr0 inet static ---- +[[sysadmin_network_vlan]] VLAN 802.1Q ~~~~~~~~~~~ @@ -498,6 +508,7 @@ iface vmbr0 inet manual bridge-stp off bridge-fd 0 bridge-vlan-aware yes + bridge-vids 2-4094 ---- The next example is the same setup but a bond is used to