---
title: "Day 2 — Proxmox Cluster, VLANs, and the First Real Mistake"
description: "Getting Proxmox VE into a proper cluster, carving VLANs in OPNsense, and the routing loop that ate an hour of my evening."
pubDate: 2024-11-08
day: 2
tags: ["proxmox", "networking", "opnsense", "vlans"]
---

## Proxmox Cluster

With two nodes up, it was time to cluster them. Proxmox's cluster setup is deceptively straightforward in the happy path. The catch is Corosync — it's very opinionated about network latency and quorum, and if you misconfigure which interface carries cluster traffic, you will have a bad time.

```bash
# On node 1:
pvecm create homelab-cluster

# On node 2:
pvecm add <node1-ip>
```

## VLAN Design

I settled on a simple scheme early and stuck to it:

| VLAN | Purpose                  | Subnet          |
|------|--------------------------|-----------------|
| 10   | Management (IPMI, etc.)  | 10.0.10.0/24    |
| 20   | Proxmox hosts            | 10.0.20.0/24    |
| 30   | Kubernetes pods          | 10.0.30.0/24    |
| 40   | Media / untrusted VMs    | 10.0.40.0/24    |
| 50   | IoT                      | 10.0.50.0/24    |

The management VLAN is firewalled hard — nothing from VLAN 40 or 50 touches it.

## The Mistake

I fat-fingered a firewall rule in OPNsense that accidentally allowed VLAN 40 to reach the Proxmox management interface. I only noticed because I was testing my GeoIP block rules and a route showed up that shouldn't have existed.

Lesson: always add a deny-all rule at the bottom of every VLAN's outbound chain, even when it feels redundant. Explicit beats implicit.
