VM network devices and configuration

Why this matters in production

A VM’s network performance and reliability depend on the NIC model, the underlying bridge configuration, and (often overlooked) the multi-queue setting.

NIC models

qm set 100 --net0 virtio,bridge=vmbr0,firewall=1

VLAN tags

The tag= option adds an 802.1Q tag to the VM’s traffic on a VLAN-aware bridge:

qm set 100 --net0 virtio,bridge=vmbr0,tag=100,firewall=1

For SDN VNets, use the VNet name as the bridge:

qm set 100 --net0 virtio,bridge=vn-web,firewall=1

Multi-queue

Modern VirtIO supports multiple queues. Each queue can be serviced by a separate host thread, enabling parallel packet processing.

qm set 100 --net0 virtio,bridge=vmbr0,queues=4

The guest must also be configured: in Linux, the kernel’s rx/tx queue count must match.

ethtool -L eth0 combined 4

MAC addresses

Each VM NIC has a MAC address. Proxmox auto-generates one. To pin a specific MAC (useful for DHCP reservations):

qm set 100 --net0 virtio=00:50:56:00:00:01,bridge=vmbr0

VM firewall

The firewall=1 option enables per-VM firewall rules. Rules are configured in the GUI under VM → Firewall or via CLI.

iptables -L -n -v | grep -i 'tap\|fwln'

The VM firewall is implemented as a separate chain on the host, attached to the VM’s tap device. It is independent of the host firewall.

Rate limiting

Proxmox’s VM firewall supports rate limiting:

qm set 100 --net0 virtio,bridge=vmbr0,rate=100

Production considerations

Common mistakes

• Using emulated NICs when VirtIO is available.
• Forgetting multi-queue on high-throughput VMs.
• Pinning MAC addresses that conflict with another VM.
• Layering VLAN tags on a non-VLAN-aware bridge.

Key takeaways

• VirtIO for all modern VMs.
• VLAN tagging works seamlessly on VLAN-aware bridges.
• Multi-queue helps high-throughput VMs.

Knowledge check