The Proxmox VE network configuration is stored in the /etc/network/interfaces file. By default, a vmbr0 bridge is set up, to which all VMs and LXC containers connect. Let's look at the main configuration scenarios.

Standard vmbr0 Bridge Configuration

# /etc/network/interfaces

auto lo
iface lo inet loopback

auto eno1
iface eno1 inet manual

auto vmbr0
iface vmbr0 inet static
    address 192.168.1.100/24
    gateway 192.168.1.1
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0

VLAN Tagging in Proxmox

Proxmox supports VLANs through a VLAN-aware bridge. This lets you isolate the traffic of different VMs on a single physical network:

# VLAN-aware bridge
auto vmbr0
iface vmbr0 inet static
    address 192.168.1.100/24
    gateway 192.168.1.1
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 2-4094

After that, when creating a VM/CT you can specify a VLAN Tag (e.g. 10, 20, 100) directly in the network interface settings.

Bonding (Link Aggregation)

For fault tolerance and increased throughput, use bonding:

>auto bond0
iface bond0 inet manual
    bond-slaves eno1 eno2
    bond-miimon 100
    bond-mode active-backup  # or 802.3ad for LACP

auto vmbr0
iface vmbr0 inet static
    address 192.168.1.100/24
    gateway 192.168.1.1
    bridge-ports bond0
    bridge-stp off
    bridge-fd 0

Isolated Private Network for VMs

Create a second bridge with no physical interface for an isolated internal network:

>auto vmbr1
iface vmbr1 inet static
    address 10.10.10.1/24
    bridge-ports none
    bridge-stp off
    bridge-fd 0

# Allow routing
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

# NAT for internet access
iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o vmbr0 -j MASQUERADE

SDN (Software-Defined Networking): Proxmox VE 9 has a full-featured built-in SDN module. Through Datacenter → SDN you can create zones, VNets, and complex topologies without editing files.

Applying Network Changes

># Check the configuration without applying it
ifreload -a -n

# Apply the changes
ifreload -a

# Or via the web interface
# Node → Network → Apply Configuration

Important: Changing the network configuration on a remote server can result in loss of access. Always verify the settings via OOB/IPMI or take a configuration snapshot first.

Network Diagnostics

# Show bridges and their ports
brctl show

# Interface statistics
ip -s link show vmbr0

# Check the routes
ip route show

# Tracing inside the VM (by name)
pvesh get /nodes/pve/qemu/100/agent/network-get-interfaces

Network configuration errors and their causes

Three errors you are most likely to hit when configuring a bridge, VLANs, and bonding — all three show up right after ifreload -a or a node reboot, so it is easiest to check the network at exactly that moment, while the change is still fresh.

RTNETLINK answers: File exists
bridge vmbr0: received packet on eno1 with own address as source address
ifup: failed to bring up vmbr0 (SIOCADDRT: Network is unreachable)

File exists: the IP address or route is already assigned to another interface — often left over from a previous configuration after a failed ifreload. Check ip addr show and ip route show for duplicates.
own address as source address: two physical ports connected to each other are plugged into the bridge, or the switch created a loop, and bridge-stp off disables loop protection. Enable bridge-stp on or physically separate the ports.
Network is unreachable: an invalid or unreachable gateway was set in the static configuration. Check that the gateway is in the same subnet as the interface address.

When a plain bridge configuration is not enough

The /etc/network/interfaces file covers the basics, but not every networking task.

You need to isolate guests from each other within a single VLAN on one bridge — a plain bridge/VLAN setup cannot do that; you need separate zones and VNets via SDN, or firewall rules at the vmbr level.
You need dynamic routing between segments (BGP/OSPF) — a static interfaces file does not fit; you need FRRouting on top of the regular Linux network stack.
You need traffic routing across multiple providers (multi-WAN) — bonding aggregates links from a single provider, but it does not handle policy routing across separate routing tables.

Verifying the result

# The bridge is up and the ports are forwarding
brctl show
bridge link show

# The VM actually receives traffic for the intended VLAN
tcpdump -i vmbr0 -e vlan

# Connectivity from the VM to the outside through the new bridge
ping -c3 -I vmbr0 8.8.8.8

If the bridge ports are active, tcpdump shows packets with the expected VLAN tag, and the ping succeeds, the network is configured correctly. For guest isolation via software-defined networking, see SDN in Proxmox VE.