SOLVED No external network for VMs with bridged interface

[briangr]

Hello Forum,

I hope somebody here has pointers for a solution. I'm not familiar with KVM so perhaps am missing an obvious step.

Environment: TrueNAS SCALE 22.02.1 for testing on ESXi with 2x VMware E1000e NICs on separate subnets plus bridged network. Confirmed that shares, permissions, general networking, etc. work.

Following the steps in the forum, this Jira ticket, and on YouTube I'm able to setup a bridged interface for VM's by assigning the IP to the bridged interface instead of the NIC. Internally this seems to work as intended, but no matter what I try, I cannot get external network connections to work from and to the bridged network.

When I remove the bridged interface and assign the IP back to the NIC itself, external connections are available again, I can ping in and out, and the GUI and shares can be contacted.

What I tried so far:
- Upgrading the 2.02.1 release to the latest nightly - No changes
- Executing the steps in different order - No effect
- Adding a second NIC for the bridged network - The GUI on a dedicated network stays alive, but no further improvements
- Made sure to reset the configuration for the NICs through the GUI - No effect
- Followed this tip to manually bind br0 to the upstream NIC - No effect but did make sure all interfaces are up
- Manually adding routes - Don't think this is needed, but no effect
- Direct connection of VM to NIC - Not sure if this is supposed to be possible, but I couldn't make it work either

Brian

 

[briangr]

On a related note, the documentation at https://www.truenas.com/docs/scale/virtualization/accessingnasfromvm/ is not available anymore.

Is it available from another location?

 

[Samuel Tai]

On a related note, the documentation at https://www.truenas.com/docs/scale/virtualization/accessingnasfromvm/ is not available anymore.

Is it available from another location?

Docs Hub | Accessing NAS From a VM

Accessing NAS From a VM

www.truenas.com

 

[briangr]

Docs Hub | Accessing NAS From a VM

Accessing NAS From a VM

www.truenas.com

Thank you Samuel! I will double check my steps.

 

[briangr]

Since somebody else testing TN Scale in a virtualized environment will probably run into the same issues, after spending way too much time on this I found that the problem is that TN Scale's bridged networking apparently triggers VMware ESXi's default network security settings.

The connected vSwitch must be set to allow forged transmits for bridged networks to be able to communicate externally:

vSphere docs: https://docs.vmware.com/en/VMware-v...UID-7DC6486F-5400-44DF-8A62-6273798A2F80.html

This might be a useful hint to add to the TN scale docs.

Brian

 

[briangr]

Docs Hub | Accessing NAS From a VM

Accessing NAS From a VM

www.truenas.com

I think there is an error in the docs or the behavior of the UI is incorrect:

Click Add in the Interfaces window. Select Bridge for the Type and give it a name (must be in brX format). Check the DHCP box, then select the active interface on the Bridge Members drop-down list. Click Add under IP Addresses and enter the active interface’s IP and subnet mask.

Shouldn't that be uncheck the DHCP box? At least on my installation checking DHCP in the UI overrides and deletes the added IP addresses. From the console it seems to work, but it doesn't make sense to me.

Brian

 

[jke]

Since somebody else testing TN Scale in a virtualized environment will probably run into the same issues, after spending way too much time on this I found that the problem is that TN Scale's bridged networking apparently triggers VMware ESXi's default network security settings.

The connected vSwitch must be set to allow forged transmits for bridged networks to be able to communicate externally:

View attachment 55412

vSphere docs: https://docs.vmware.com/en/VMware-v...UID-7DC6486F-5400-44DF-8A62-6273798A2F80.html

This might be a useful hint to add to the TN scale docs.

Brian

Huge thank you for this!!!
For me the forged transmits was already enables, but promiscuous mode was not.
Once I enabled it the bridge started to work.