Proxmox Deep Dive Part 4: Networking - Bridges, VLANs, and SDN

Part 3 closed out storage. This part covers networking, starting from the same single bridge Part 1 mentioned the installer creates by default.

Linux bridges: the foundation everything else builds on.

Every VM and container’s virtual network interface attaches to a Linux bridge (vmbr0, vmbr1, and so on), never directly to a physical NIC. A bridge behaves like a virtual switch: anything attached to it, physical NIC, VM interface, or another bridge port, can reach anything else attached to it at layer 2. This is the exact mechanism behind the vmbr-sniperlab and vmbr-msflab bridges already running on the pve host behind the Sn1per and BloodHound lab work, one isolated bridge per lab network, with no physical NIC attached at all when the lab needs to stay fully air-gapped from the rest of the network.

VLAN-aware bridges and bonding.

A bridge can be made VLAN-aware, letting a single bridge carry multiple VLANs and letting each VM’s virtual NIC be assigned a VLAN tag directly in its configuration, rather than needing one bridge per VLAN. This scales far better once a homelab is running more than a handful of isolated networks. Bonding (802.3ad/LACP or one of the non-LACP modes) combines multiple physical NICs into one logical link, for either throughput or redundancy, and a bond can itself be the physical interface a bridge attaches to, combining both features.

SDN: a newer layer on top of bridges, for when plain bridges start running out of road.

Proxmox’s Software-Defined Networking stack adds a layer above plain bridges and VLANs, useful once a homelab’s networking needs outgrow what a handful of manually configured bridges can express cleanly. SDN is organized around zones, each zone declaring a networking technology: Simple (an isolated bridge, roughly what manual vmbr configuration already provides), VLAN, QinQ, VXLAN, or EVPN. VNets are the actual virtual networks created within a zone, the thing a VM’s NIC actually attaches to.

EVPN zones are the most capable option: they build routable, BGP-controlled Layer 3 networks on top of VXLAN, using FRRouting (FRR, the same open-source routing daemon covered in this site’s own OSPF on Linux series) as the control plane. EVPN zones support anycast gateway IP/MAC addresses and VRF interfaces for routing between VNets, which is genuinely the same territory as a small SD-WAN fabric, multiple sites (or in this case, multiple Proxmox nodes) sharing a common overlay with BGP handling the routing between them.

Where the extra complexity actually earns its keep.

For a single-node homelab, or even a small cluster with a handful of static VLANs, plain bridges plus VLAN tagging cover the need completely, and SDN’s zone/VNet abstraction is complexity without a payoff. SDN starts earning its keep once the same virtual network needs to span multiple physical nodes without hand-wiring a VXLAN tunnel manually, or once a homelab starts modeling something closer to production multi-site routing rather than a flat set of isolated lab bridges. The vmbr-sniperlab/vmbr-msflab pattern already in use on the pve host is deliberately in the “plain bridges are enough” category, each lab needs isolation, not routed connectivity to anything else, so a Simple zone (or just a manually created bridge, which is functionally the same thing) is the right level of complexity for that job, not an EVPN overlay that would solve a problem this use case doesn’t have.

Part 5 covers the layer that sits directly on top of this networking foundation: Proxmox’s own firewall, which operates at the datacenter, node, and VM/container level simultaneously.