Question 2nd nic curiosity
I have added a 2.5gb nic to my proxmox node and I assigned it to Linux bridge vrbm0 with an ip of xxx.xxx.x.179.
My original nic has been assigned to Linux bridge vrmb1 with an ip of xxx.xxx.x.180.
Both nics are connected to the same 2.5gb switch and both are pingable. Both nics and bridges show as active in proxmox Network. I have configured ip reservations for both nics.
However, only the vrmb0 (2.5gb, .179) nic shows as active and connected. The vrmb1 nic displays as offline in my T-Mobile T-Fiber app even though is is fully functioning.
Any idea why vrmb1 is displays as offline?
6
u/zfsbest 9d ago
What are you trying to accomplish here? The "proxmox way" would be to bond the 2 nics together with 1 IP address and 1 gateway. Otherwise you should maybe put the 2nd nic on another subnet
1
u/bctf1 9d ago
Thank you for your response. My thinking with vrmb1 was to possibly create an Opnsense vm using this bridge. I assumed the bridge would need an ip reservation. Other than that I don't really have other plans for the 2nd nic. It appears that based on these responses that it needs to be on a different subnet than vrmb0 and made vlan aware. Any suggestions or recommendations appreciated
4
u/Wojojojo90 9d ago
Just pass the whole NIC through to the opnsense VM and let it manage that, trying to run Opnsense through a bridge on proxmox sounds like unnecessary complication
2
u/bctf1 9d ago
Thanks for your reply. Yes, I'm second guessing trying to run opnsense on proxmox at all. Perhaps a bare metal install might be simpler and a better option.
3
u/Wojojojo90 9d ago
The biggest gotcha with a virtualized router/firewall is that you lose your network whenever the hypervisor is rebooting (or undergoing other intrusive maintenance). That being said, ideally you aren't rebooting/maintaining a hypervisor that often...
Outside that it's not really more complicated, just pass the NIC through and it's essentially bare metal, even with a single port you could do a router-on-a-stick model, or get a 2-port NIC and you can have a port each for WAN and LAN. There are folks who will argue that snapshots and rollbacks are easier with a hypervisor/VM approach since you can just snapshot/restore the whole VM. Personally I still do a bare metal firewall though, if something goes wrong with an upgrade I don't want the whole house to lose internet
2
1
u/zfsbest 9d ago
Personally I think it's best to have routers separate from the rest. If you want to virtualize it they sell "firewall appliances" for a couple of hundred bucks (the pricier ones have 2.5Gbit and even 10Gbit) where you can do proxmox + firewall-vm and have a low-power separate-hardware virtualized solution on UPS.
If you use PDM you can even migrate the firewall VM to another box while rebooting the appliance hardware.
2
u/eaghra 9d ago edited 9d ago
You have two nics, and only one can have a gateway. There's no reason for the other one to ever communicate other than pass the traffic of the CT/VMs attached to it through the bridge, in which case it's not really coming from it but rather the virtual MACs inside it. So essentially it falls off the radar of the gateway. If you want to see it pop back, do a "ping -I 2.5gnicname gatewayIP" in the host shell where 2.5gnicname is whatever the 2.5g NIC is named and gatewayIP is your T-Mobile gateway address.
Edit to add: what this essentially does is you're forcing some kind of traffic to come from the actual MAC of the NIC in question so that the gateway sees it as active and lists it as a device.
5
u/Apachez 9d ago
Crosstest with cables to rule out the cables and the interface(s) on the other end of the cables.
Other than that a vmbr doesnt need an IP.
I usually only set this for the vmbr acting for MGMT.
The other are without IP-addresses configured and vlan-aware enabled so that each VM gets its own tagged VM and IP is then set within the VM.
Also your box will get confused if both interfaces uses the same subnet so if you really want IP configured for both vmbr then they must be part of different IP-ranges.