pve-network.adoc: move network docu into separate file
[pve-docs.git] / pve-network.adoc
1 Network Configuration
2 ---------------------
3 include::attributes.txt[]
4
5 {pve} uses a bridged networking model. Each host can have up to 4094
6 bridges. Bridges are like physical network switches implemented in
7 software. All VMs can share a single bridge, as if
8 virtual network cables from each guest were all plugged into the same
9 switch. But you can also create multiple bridges to separate network
10 domains.
11
12 For connecting VMs to the outside world, bridges are attached to
13 physical network cards. For further flexibility, you can configure
14 VLANs (IEEE 802.1q) and network bonding, also known as "link
15 aggregation". That way it is possible to build complex and flexible
16 virtual networks.
17
18 Debian traditionally uses the 'ifup' and 'ifdown' commands to
19 configure the network. The file '/etc/network/interfaces' contains the
20 whole network setup. Please refer to to manual page ('man interfaces')
21 for a complete format description.
22
23 NOTE: {pve} does not write changes directly to
24 '/etc/network/interfaces'. Instead, we write into a temporary file
25 called '/etc/network/interfaces.new', and commit those changes when
26 you reboot the node.
27
28 It is worth mentioning that you can directly edit the configuration
29 file. All {pve} tools tries hard to keep such direct user
30 modifications. Using the GUI is still preferable, because it
31 protect you from errors.
32
33 Naming Conventions
34 ~~~~~~~~~~~~~~~~~~
35
36 We currently use the following naming conventions for device names:
37
38 * Ethernet devices: eth[N], where 0 ≤ N (`eth0`, `eth1`, ...)
39
40 * Bridge names: vmbr[N], where 0 ≤ N ≤ 4094 (`vmbr0` - `vmbr4094`)
41
42 * Bonds: bond[N], where 0 ≤ N (`bond0`, `bond1`, ...)
43
44 * VLANs: Simply add the VLAN number to the device name,
45 separated by a period (`eth0.50`, `bond1.30`)
46
47 This makes it easier to debug networks problems, because the device
48 names implies the device type.
49
50 Default Configuration using a Bridge
51 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
52
53 The installation program creates a single bridge named `vmbr0`, which
54 is connected to the first ethernet card `eth0`. The corresponding
55 configuration in '/etc/network/interfaces' looks like this:
56
57 ----
58 auto lo
59 iface lo inet loopback
60
61 iface eth0 inet manual
62
63 auto vmbr0
64 iface vmbr0 inet static
65 address 192.168.10.2
66 netmask 255.255.255.0
67 gateway 192.168.10.1
68 bridge_ports eth0
69 bridge_stp off
70 bridge_fd 0
71 ----
72
73 Virtual machines behave as if they were directly connected to the
74 physical network. The network, in turn, sees each virtual machine as
75 having its own MAC, even though there is only one network cable
76 connecting all of these VMs to the network.
77
78
79 Routed Configuration
80 ~~~~~~~~~~~~~~~~~~~~
81
82 Most hosting providers do not support the above setup. For security
83 reasons, they disable networking as soon as they detect multiple MAC
84 addresses on a single interface.
85
86 TIP: Some providers allows you to register additional MACs on there
87 management interface. This avoids the problem, but is clumsy to
88 configure because you need to register a MAC for each of your VMs.
89
90 You can avoid the problem by "routing" all traffic via a single
91 interface. This makes sure that all network packets use the same MAC
92 address.
93
94 A common scenario is that you have a public IP (assume 192.168.10.2
95 for this example), and an additional IP block for your VMs
96 (10.10.10.1/255.255.255.0). We recommend the following setup for such
97 situations:
98
99 ----
100 auto lo
101 iface lo inet loopback
102
103 auto eth0
104 iface eth0 inet static
105 address 192.168.10.2
106 netmask 255.255.255.0
107 gateway 192.168.10.1
108 post-up echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
109
110
111 auto vmbr0
112 iface vmbr0 inet static
113 address 10.10.10.1
114 netmask 255.255.255.0
115 bridge_ports none
116 bridge_stp off
117 bridge_fd 0
118 ----
119
120
121 Masquerading (NAT) with iptables
122 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
123
124 In some cases you may want to use private IPs behind your Proxmox
125 host's true IP, and masquerade the traffic using NAT:
126
127 ----
128 auto lo
129 iface lo inet loopback
130
131 auto eth0
132 #real IP adress
133 iface eth0 inet static
134 address 192.168.10.2
135 netmask 255.255.255.0
136 gateway 192.168.10.1
137
138 auto vmbr0
139 #private sub network
140 iface vmbr0 inet static
141 address 10.10.10.1
142 netmask 255.255.255.0
143 bridge_ports none
144 bridge_stp off
145 bridge_fd 0
146
147 post-up echo 1 > /proc/sys/net/ipv4/ip_forward
148 post-up iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eth0 -j MASQUERADE
149 post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eth0 -j MASQUERADE
150 ----
151
152 ////
153 TODO: explain IPv6 support?
154 TODO: explan OVS
155 ////