Skip to main content
RunBook Academy

← All labs in Proxmox VE

Lab · intermediate · ~30 min

Set up SDN with a VLAN zone and verify isolation

A · Physical hardwareB · Nested virtualisationC · Simulation

Objectives

  • Create an SDN VLAN zone with two VNets on different tags
  • Create VMs that use each VNet
  • Verify the VMs cannot reach each other (different subnets, no firewall)
  • Verify VMs on the same VNet can reach each other

Prerequisites

  • A cluster with a VLAN-aware bridge
  • Two VM templates (one per subnet) available on the cluster
  • DHCP enabled in the SDN config so VMs get addresses automatically

Set up SDN with VLAN zone

SDN lets you describe network topology declaratively and apply it across the cluster atomically. This lab proves isolation works as expected.

Steps

1. Create the zone

GUI: Datacenter → SDN → Zones → Add.

  • ID: corp
  • Type: VLAN
  • Bridge: vmbr0

2. Create two VNets

VNet 1: web

  • Subnet: 10.10.100.0/24
  • Gateway: 10.10.100.1

VNet 2: db

  • Subnet: 10.10.200.0/24
  • Gateway: 10.10.200.1

Enable DHCP on both.

3. Apply

Click Apply in the SDN panel. This pushes the configuration to all nodes via pmxcfs.

4. Create two test VMs

qm create 1001 --name web-01 --memory 1024 --net0 name=web,bridge=vmbr0 \
  --ipconfig0 ip=dhcp --scsihw virtio-scsi-single --scsi0 local-zfs:8
qm create 1002 --name db-01 --memory 1024 --net0 name=db,bridge=vmbr0 \
  --ipconfig0 ip=dhcp --scsihw virtio-scsi-single --scsi0 local-zfs:8
qm start 1001
qm start 1002

5. Verify isolation

Wait for both VMs to boot and acquire DHCP addresses:

# Substitute the addresses DHCP handed out:
WEB01_IP=10.10.100.10
DB01_IP=10.10.200.10

# Inside web-01
ip addr show
ping -c 3 "$DB01_IP"   # Should FAIL

# Inside db-01
ping -c 3 "$WEB01_IP"  # Should FAIL

The two subnets must not be able to reach each other without a firewall rule. (In a real environment you’d add a routed gateway; here we are testing the isolation.)

6. Verify same-VNet connectivity

Create a second VM in the web VNet:

qm create 1003 --name web-02 --memory 1024 --net0 name=web,bridge=vmbr0 \
  --ipconfig0 ip=dhcp --scsihw virtio-scsi-single --scsi0 local-zfs:8

From web-01:

# Substitute the address DHCP handed out:
WEB02_IP=10.10.100.11

ping -c 3 "$WEB02_IP"   # Should succeed

Verification

  • web-01 ↔ web-02: ping succeeds (same VNet, same subnet)
  • web-01 ↔ db-01: ping fails (different VNets, no routed path)
  • The SDN panel shows both VNets active on all nodes
  • cat /etc/pve/sdn/firewall/<zone>.fw (if firewall is enabled) reflects the configured rules

Cleanup

# Delete the VMs
qm stop 1001 1002 1003
qm destroy 1001 1002 1003

# Remove the SDN zone (this also removes VNets)
# Datacenter → SDN → Zones → Delete

Deliverables

  • · Two SDN VNets in a VLAN zone, each with its own subnet
  • · VM in each VNet, pingable within VNet, not across

Verification status

Executed end to end
not yet run on hardware

The commands and configuration here have been reviewed against the verified software versions, but nobody has run this lab start to finish on a system meeting its prerequisites. Treat the Expected Outcome as the intended result rather than an observed one, and keep the Cleanup section to hand.