SDN & project networks

NexoVirt turns Proxmox’s Software-Defined Networking (SDN) into a per-project feature: define a network template once, and every project gets its own isolated VNet, subnet, IP management and internet egress, without editing the SDN stack by hand.

What it is

Proxmox SDN provides zones, VNets and subnets. On their own they are manual: you carve subnets, wire DHCP and configure NAT for each tenant yourself. NexoVirt adds:

• SDN templates: a reusable definition (like a plan, but for networking): a zone type, a supernet to carve subnets from, DHCP and SNAT defaults, and firewall defaults.
• SDN projects: a customer or project grouping that, when created, gets its own isolated VNet and subnet carved from the template’s supernet.
• Attach at provisioning: the guest create wizard offers the active project networks; picking one puts the guest straight onto that VNet.
• VPN access: WireGuard configs that reach only the networks of chosen projects.

Both pages are in the sidebar under Networking: SDN projects and SDN templates. The node page’s Network tab has an SDN projects tile, and the node’s Network map page shows the connection’s SDN zones, VNets, subnets and controllers read-only.

How to use it

1. Create a template: Networking > SDN templates, then New template. Set a Name, the Zone type (simple, vlan, qinq, vxlan or evpn), a Zone id (up to 8 lowercase letters or digits, starting with a letter), the Supernet CIDR (for example 10.90.0.0/16) and the Per-project prefix (for example 28 for a /28 per project). Toggle SNAT (masquerade) and DHCP, and click Create template.
2. Create a project: Networking > SDN projects, then New project. Enter a Project name, optionally a Customer (leave “(none / admin-owned)” for your own use), the Node / cluster and the SDN template, then Create project. The network is provisioned in the background; the projects table refreshes on its own and shows the status pending, then active (or failed with the reason and a Retry action).
3. Create a guest on the project: in the create wizard’s network step, pick the VNet from the Project networks (isolated SDN) group instead of a physical bridge. The guest boots onto the isolated VNet.

Optional template fields: Description, IPAM (default pve), MTU, Advanced zone parameters (one key=value per line, type-specific, for example bridge for VLAN, peers for VXLAN, controller / vrf-vxlan for EVPN; unknown keys are ignored), Gateway host offset, DHCP start offset / DHCP end offset, the firewall defaults (Enable firewall on the VNet, Default inbound policy, Default outbound policy) and Active.

Deleting a project marks it deleting, removes its VNet and subnet from the cluster in the background and then deletes the project.

IPs are assigned automatically

Each project gets its own IPAM. With DHCP on, the project’s dnsmasq hands out addresses and panel IP zones do not apply. With DHCP off, the wizard shows a Static IPv4 field: leave it blank and NexoVirt assigns the next free address from the project subnet, or enter a specific in-subnet address.

How it works

• Zone, VNet, subnet. The template’s zone is created (or reused) on the Proxmox cluster; each project gets a VNet in that zone and a subnet carved from the supernet, with its gateway on the node.
• DHCP. When the template enables DHCP, NexoVirt uses Proxmox’s per-zone dnsmasq backend. The node agent installs dnsmasq only if it is not already present and never disturbs an existing DHCP setup. If DHCP cannot be enabled safely, the project still becomes active and shows a note: guests on it use a static IP.
• IPAM. A project’s subnet is its own address pool, so allocations and releases happen automatically as guests are created and deleted.
• Egress (SNAT). With SNAT on, guests reach the internet through the node’s WAN via masquerade. This needs IPv4 forwarding, which the agent turns on (and persists) when the project is provisioned. If that fails, the project shows a note.

IPv4 forwarding is required for internet access

A private SDN subnet can only reach the internet if the node forwards IPv4. You can check and toggle it on the node page’s Network tab (IPv4 forwarding card).

Reaching a guest from outside

An SDN network is isolated by design: you cannot reach a guest’s private address from your LAN. Outbound traffic works through SNAT. For inbound access you have two options:

• Port forward: on the node page, Network tab, open NAT & port forwarding, add a forward from a public port to the guest’s private address and port, then Apply now. Reach the guest at the node’s address on that port (for example ssh -p 2222 -l root node.example.com). A forward may target any of the connection’s SDN project subnets, see Networking & NAT.
• VPN: a WireGuard config for the project (next section).

VPN access for a project

An SDN projects VPN config reaches only the subnets of the projects you pick: no node, no LAN, no other project. The node must have the VPN enabled.

• On the project: the project edit page has a VPN access card (shown to admins who may manage hosts) listing the configs that include this project, with a field to create a new one (for example contractor-laptop) and Create config. Manage VPN configs opens the VPN page.
• On the VPN page: New config, Reaches: SDN projects, then pick one or more projects.
• Customers (Enterprise) can create such configs in the portal for their own projects.

A project that has no subnet yet is listed as “No network yet” on the config. When a project is deleted, its configs lose access to it; a config with no projects left shows “No projects left: revoke this config.”

Static IPs and container images

DHCP works with any guest image. A static IP (a DHCP-off project) only works if the guest OS applies the address at boot: standard Proxmox Debian and Ubuntu CT templates do; minimal or cloud images (netplan, no ifupdown) often do not. In the CT template library, leave Applies static IPs off for such images; NexoVirt then blocks them on DHCP-off project networks. Or use DHCP.

Requirements

• Proxmox VE with SDN (standard on current releases).
• A healthy, current host agent on the node (for the DHCP backend and IPv4 forwarding), see the agent.
• A WAN bridge on the node for SNAT egress and port forwards.

Limitations current

• The firewall defaults are stored on the template but not yet applied to the VNet. Isolation, DHCP and SNAT are.
• Static-IP mode depends on the guest image applying the address (see above).

The host agentPowers the DHCP backend and IPv4 forwarding for SDN.

Networking & NATPort-forward into an SDN guest, IP zones, firewall.

WireGuard VPNConfigs that reach only a project's network.

GuestsAttach a guest to a project network at create time.