Proxmox Network Configuration for MetalLB Subnet

📚 Navigation: Main README | Documentation Index | Traefik Connectivity Fix

Overview

The 10.0.2.8/29 subnet needs to be properly configured in Proxmox to ensure MetalLB can announce and route traffic to the LoadBalancer IPs.

Related Documentation:

Traefik External Connectivity Fix - Troubleshooting LoadBalancer access
MetalLB Configurations - Kubernetes MetalLB resources
Configuration Scripts - Network configuration automation
Main README - Network architecture overview

Current Configuration Analysis

Based on your Terraform configuration:

Public Bridge: vmbr1
Private Bridge: vmbr2
Node IPs: 10.0.1.211-213 (on public bridge)
MetalLB Subnet: 10.0.2.8/29 (needs routing)

Required Proxmox Configuration

1. Network Bridge Configuration

The 10.0.2.8/29 subnet needs to be routable through your public bridge (vmbr1). You have several options:

Option A: Add Subnet to Existing Bridge (Recommended)

# On Proxmox host, add the subnet as an additional IP range
# This allows the bridge to route traffic to the subnet

# Check current bridge configuration
ip addr show vmbr1

# Add subnet route (if not automatically routed)
ip route add 10.0.2.8/29 dev vmbr1

# Make permanent by adding to /etc/network/interfaces

Option B: Create Dedicated Bridge for MetalLB

# Create a new bridge specifically for MetalLB traffic
# This provides better isolation but requires more configuration

2. Proxmox Network Interfaces Configuration

Edit /etc/network/interfaces on your Proxmox host:

# Current configuration (example)
auto vmbr1
iface vmbr1 inet static
    address 10.0.1.XXX/24
    gateway 10.0.1.1
    bridge-ports eth0
    bridge-stp off
    bridge-fd 0

# Add MetalLB subnet routing
# Option 1: Add as additional address
auto vmbr1:1
iface vmbr1:1 inet static
    address 10.0.2.8/29

# Option 2: Add routing rules
up ip route add 10.0.2.8/29 dev vmbr1
down ip route del 10.0.2.8/29 dev vmbr1

3. Firewall Configuration

Ensure Proxmox firewall allows traffic to the MetalLB subnet:

# Add firewall rules for MetalLB subnet
# Allow HTTP/HTTPS traffic to MetalLB IPs
iptables -A FORWARD -d 10.0.2.8/29 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 10.0.2.8/29 -p tcp --dport 443 -j ACCEPT

# Allow all traffic to MetalLB subnet (less restrictive)
iptables -A FORWARD -d 10.0.2.8/29 -j ACCEPT

Implementation Steps

Step 1: Check Current Network Configuration

# SSH to your Proxmox host
ssh root@your-proxmox-host

# Check current bridge configuration
ip addr show vmbr1
ip route show

# Check if subnet is already routable
ping -c 1 10.0.2.9

Step 2: Configure Network Routing

Choose one of these approaches:

Approach A: Simple Routing (Recommended)

# Add route for MetalLB subnet through public bridge
ip route add 10.0.2.8/29 dev vmbr1

# Test connectivity
ping -c 1 10.0.2.9

# If successful, make permanent
echo "up ip route add 10.0.2.8/29 dev vmbr1" >> /etc/network/interfaces
echo "down ip route del 10.0.2.8/29 dev vmbr1" >> /etc/network/interfaces

Approach B: Bridge Alias (Alternative)

# Add subnet as bridge alias
ip addr add 10.0.2.8/29 dev vmbr1

# Make permanent in /etc/network/interfaces
cat >> /etc/network/interfaces << EOF

auto vmbr1:metallb
iface vmbr1:metallb inet static
    address 10.0.2.8/29
EOF

Step 3: Configure Firewall Rules

# Allow traffic to MetalLB subnet
iptables -I FORWARD -d 10.0.2.8/29 -j ACCEPT

# Save iptables rules (method varies by distribution)
iptables-save > /etc/iptables/rules.v4
# or
netfilter-persistent save

Step 4: Verify Configuration

# Check routing
ip route show | grep 198.55.108

# Test connectivity from Proxmox host
curl -I http://10.0.2.9

# Check from external network
# (from another machine)
curl -I http://10.0.2.9

Terraform Integration

Your terraform.tfvars already includes the subnet:

metallb_addresses = ["10.0.1.214/32", "10.0.2.8/29"]

However, this doesn't automatically configure Proxmox networking. The subnet configuration must be done on the Proxmox host itself.

Troubleshooting

Issue: MetalLB IPs not reachable externally

Symptoms:

MetalLB assigns IPs correctly
Services show EXTERNAL-IP from subnet
External connectivity fails

Solutions:

Check Proxmox routing:
```
ip route show | grep 198.55.108
```
Verify bridge configuration:
```
brctl show vmbr1
ip addr show vmbr1
```
Test from Proxmox host:
```
curl -I http://10.0.2.9
```
Check firewall rules:
```
iptables -L FORWARD | grep 198.55.108
```

Issue: ARP resolution problems