Proxmox VE Network: VLANs on Linux Bridges

Proxmox VE builds its virtual networking on the Linux network stack: a bridge (vmbrX) acts as a virtual switch that guests and physical NICs plug into. Getting VLANs right on that bridge is the difference between a hypervisor that plays nicely with your physical switch trunks and one that leaks or drops traffic. Proxmox supports two models: per-VLAN sub-interfaces (vmbr0.100 style) for simple cases, and VLAN-aware bridges where one bridge carries every VLAN and each VM gets a tag - the model Proxmox recommends for anything beyond a handful of networks. This guide explains both, with /etc/network/interfaces examples and the safe way to apply changes.

How Proxmox Bridges and VLANs Work

A Linux bridge is a virtual switch. The physical NIC is a bridge port, VMs connect to the bridge, and traffic to the physical network flows through the NIC. Two VLAN strategies exist:

• VLAN sub-interfaces: create vmbr0.100 for VLAN 100 and connect a VM to that interface. The hypervisor tags all traffic on it.
• VLAN-aware bridge: enable bridge-vlan-aware on vmbr0; every VM gets a vlan tag and the kernel handles 802.1Q tagging per VM on one shared bridge.

VLAN-Aware Bridge Configuration

Edit /etc/network/interfaces (or use the GUI, which stages changes in /etc/network/interfaces.new):

auto vmbr0
iface vmbr0 inet manual
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 2-4094

With this in place, attach a VM to vmbr0 with VLAN tag 100 in the VM's network settings (GUI field VLAN Tag, or the vlan parameter in the VM config file), and traffic egresses tagged as VLAN 100.

Classic VLAN Sub-Interface Configuration

The older model creates one bridge per VLAN, tagging on the hypervisor side:

auto vmbr0
iface vmbr0 inet manual
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0

auto vmbr0.100
iface vmbr0.100 inet manual
    vlan-raw-device vmbr0

VMs attached to vmbr0.100 are then in VLAN 100; add a management address on vmbr0.100 if the hypervisor itself must be reachable in that VLAN.

Bond + VLAN for Redundant Trunks

For two NICs to a switch (or two switches with LACP), bond first and build the VLAN bridge on top:

auto bond0
iface bond0 inet manual
    bond-slaves eno1 eno2
    bond-mode 802.3ad
    bond-miimon 100
    bond-xmit-hash-policy layer3+4

auto vmbr1
iface vmbr1 inet manual
    bridge-ports bond0
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 2-4094

Applying Changes Safely

Proxmox writes GUI changes to interfaces.new first and applies them on click. If you edit the file directly, use ifupdown2's live reload - a bad network change can otherwise render the node unreachable:

# apt install ifupdown2
# ifreload -a

Verify the result:

# ip -d link show vmbr0
# bridge vlan show
# networkctl status vmbr0

Related articles: Open vSwitch bridge and VLAN configuration, Linux VLAN tagging with ip link, and Linux bonding modes.

原文链接：https://pve.proxmox.com/wiki/Network_Configuration