I have recently decided to abandon the painful SSH port forwarding method of managing my infrastructure. SSH port forward is very useful but when you start to have to manage more and more systems all the hasle to port forward local ports is too much.
Before deploying my servers I had openVPN configured and working but when I have moved my servers to the datacentre I did not go through the reconfiguration of the IP addresses. After more then 6 months suffering with SSH I have decided to bring my VPN up and after seeing ip addresses instead of localhost:port I have decided to properly configure my VPN to manage my infrastructure.
However, a problem with IP ranges overlapping between my home network and my infrastructure surfaced imediately forcing me to change the ranges/vlans either in my infrastructure or home network and I have decided to change my servers because I have much less networks and it would be relatively easier.
Let's use the example of changing the proxmox VLAN that is using the veth pair
veth1 on VLAN 10 to VLAN 2.
root@hv1:~# bridge v s port vlan ids vmbr0 None veth1 10 PVID Egress Untagged team2 10 20 30 tap101i0 10 20 30 tap102i0 30 PVID Egress Untagged tap100i0 30 PVID Egress Untagged
First, add the VLAN 2 to
tap101i0 that are the physical trunks between hypervisors and firewall trunk respectively.
root@hv1:~# bridge vlan add dev team2 vid 2 master root@hv1:~# bridge vlan add dev tap101i0 vid 2 master
We now need to change the interface that proxmox is using and when changed will lock us out of the system.
Add the new VLAN to it and then delete the old one.
root@hv1:~# bridge vlan add dev veth1 vid 2 pvid untagged master root@hv1:~# bridge vlan del vid 10 dev veth1
We will be disconected from our host at this point and the changes will now be on our firewall.
pFsense does not allow a VLAN modification for an interface that is asssigned and we need to delete the assignment.
Before deleting the assignmente make sure to take note of your firewall rules, because they will be deleted.
Interface Assignments > Interfaces and delete your interface assigned to VLAN10.
Interfaces > VLANs and edit your VLAN10 and save the changes.
Interfaces > Interface Assignments we will assign the VLAN2 interface to our trunk
Because The IP address is not being changed, CARP IP, NAT Outbound and NAT forwardings do not need to be changed. However, we need to set up DHCP and firewall rules.
We can now do the same steps above in the second hypervisor to complete the changes.