Skip to content

Networking

Every VM and container you create attaches to vmbr0 by default and "just gets on the network." This chapter explains what vmbr0 is, so that the day it doesn't "just work," you know where to look.

The bridge, plainly

vmbr0 is a Linux bridge — a virtual network switch inside the Proxmox host. Picture it:

Your home LAN ──(cable)── [physical NIC: eno1]
                                    │
                               ┌─ vmbr0 ─┐
                               │ (bridge) │
                               └──┬───┬───┘
                                  │   │
                              VM 100  CT 101

The host's physical network card is plugged into the bridge, and each guest gets a virtual cable to the same bridge. To your router, VM 100 looks like just another device asking for DHCP — it gets a normal LAN address (192.168.1.x) and talks to everything directly. No NAT, no port forwarding, no special cases.

From the docs: this default bridge setup is created by the Proxmox installer and documented in the official network documentation.

What this means in practice

  • Guests get LAN IPs from your router's DHCP, like any physical device. Give important ones static addresses or DHCP reservations in the router.
  • Guests can reach the internet, each other, and your LAN — and your LAN can reach them. Your Proxmox host is not a firewall between guests and the network by default.
  • The Proxmox web UI itself lives on the host's address (https://192.168.1.50:8006), independent of the bridge.

Virtio: the fast virtual network card

When creating a VM, the network device model defaults to VirtIO (paravirtualized). In plain terms: instead of pretending to be a specific physical network card, the guest gets a purpose-built fast lane that both sides understand. It's the right default — near-native speed, minimal CPU. Change it only if a guest OS lacks VirtIO drivers (old Windows needs the VirtIO driver ISO during install — from the docs).

The firewall (exists, off by default)

Proxmox ships a firewall — at datacenter, node, and guest level — but it's disabled by default at home. The Cybersecurity guide threat-model thinking applies: on a trusted home LAN, the default open posture is fine; if you expose guests to the internet, revisit this. Firewall detail is beyond this guide's scope.

VLANs, briefly

A VLAN tag on a guest's network device puts it on a separate virtual LAN — useful for isolating, say, IoT experiments from your main network. It requires a VLAN-aware switch or router to mean anything. Mentioned so the option looks familiar; not taught here.

The one idea to keep

vmbr0 is a virtual switch: guests plug into it and appear as ordinary devices on your LAN. VirtIO is the fast virtual NIC — leave it alone. Next: what happens with more than one Proxmox box, in Clustering, Lightly.