Jump to content
buzzkillb

Pfsense VLAN setup for Proxmox Container VLAN

Recommended Posts

334

500 posts
1223 BF$

image.thumb.png.cf0116ef9c11406377cc060ebf2bfcf0.pngDecided to try out Pfsense to compare to the Ubiquiti USG with VLAN's. Pfsense seems a bit easier, but a few more steps to setup. With that in mind I wanted to see how to VLAN a Proxmox Container. I am using a small celeron - 2 Intel NIC mini PC for Pfsense, a Ubiquiti Edgeswitch 24, and for Proxmox - Threadripper 16core on an x399 motherboard with 2 Intel NICS. I think you want 2 NICS for Proxmox, and a managed switch.

First setup the VLAN on Pfsense. I am calling mine DockerProxmox and using vlanid 600.

Go to Interfaces -> VLANs click Add and change to something like below
Parent Interface is your LAN, VLAN tag is 600, Description Docker Proxmox. LAN is important and the rest is up to you.

image.png.0179560ffb5aa72595ed618f308fdc50.png

Go to Interfaces -> Assignments and find the one at the bottom, your new VLAN and click Add. Then Click OPT or whatever the Description is.

Once you click Description change the fields below. Pick an IPv4 address for the new subnet, I chose 192.168.60.1

image.thumb.png.9c4319b008075300844064fe22fa3299.png

Go to Services -> DHCP Server and find your new VLAN at the top and click that. We now want an IP range to hand out. I like to choose between 100-200 like below.

image.thumb.png.21606aec566f0ed2d68ceb05e59a87e9.png

Go to Firewall -> Rules. A quick firewall rule to to allow traffic and also block traffic to the rest of the network which will look like this.

image.thumb.png.4c6d3c49c59fe3d422e026dd01e7c73d.png

Allow All Rule

image.thumb.png.bdfaeb554cba964a9fba8580e7a7fdd7.png

Block LAN Rule

image.thumb.png.b13ad90d5df5d13287b16f2e138ef2b7.png

Then go into your Switch to configure the Tag Port, this is going to vary but here's an example on my Port 20.

image.png.3851adf64407d5f5ace7c595c2c59482.pngimage.png.f646fc0427772492947dd4617d7f5904.png

So you already have Proxmox setup with a static IP on one of the NICS. Now lets use the 2nd NIC to bring the VLANs through. The above shows I have my management Proxmox port on 19, and the 2nd VM NIC will be in Port 20.

This is the goal of what we are about to change.

image.thumb.png.43d6bc1bd58a5fd59c801ff42822c10d.png

enp4s0 is plugged into port 19 like normal and was setup through Proxmox as vmbr0 when I setup the server. So then I would click create Linux Bridge and make a vmbr1 with VLAN aware and bridge port of the other NIC, enp6s0 like this.

image.png.601cc7309efe8113d618bf9930bef732.png

Now create a container using vmbr1 and use VLAN ID of 600 or whatever number you used and the container will get the new IP range from DHCP and can't ping any other IP's outside of the range.

On the Container creation, it would look like this for Network tab.

image.png.99bc3731289cf45b9f3df5b0fd8345cc.png

For DNS tab, I am using my pihole IP address which I made 2 separate rules for, otherwise I could not get out to the internet because of the above rules and basically blocking my pfsense IP. Looks like this below. Eventually would tune everything down to correct ports only, so I am not passing everything to the pihole. Or just use 8.8.8.8 or whatever you use in the DNS tab.

image.thumb.png.cf0116ef9c11406377cc060ebf2bfcf0.png

And a successful ping to google.com so big brother knows we are here, but can't ping internal network. Good enough for a somewhat quick Pfsense VLAN into a Proxmox Container to start locking things down.

image.png.2335714f694ee04b531d08bda0684c30.png

 

 

 

 

 

  • Like 1

If you enjoy my content please consider donating to the Denarius creator - https://www.patreon.com/carsenk
Join Denarius Discord - https://discord.gg/JQEmXwb

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×
×
  • Create New...