Proxmox Networking Linux Bridge vs OVS Bridge

Proxmox virtual switches and networking demystified: Trunk-mode Ports and Access-mode Ports

One common question regarding Proxmox network setup is WHICH of the options to use when creating Proxmox network interfaces when you need to pass multiple VLANs across a Trunk-mode switch port versus simple access-mode port setups.

Here's a quick cheat sheet:

Trunk mode required:

Linux VLAN interfaces (eno1.10, bond0.20)
Physical NIC (eno1)
└── VLAN interface (eno1.10)
└── Linux Bridge (vmbr10)
└── VM vNICs

VLAN-tagged OVS IntPorts
Physical NIC (eno1)
└── OVS Bridge (ovsbr0)
├── OVS Port (eno1) ← uplink, trunk to switch
└── OVS IntPort (vlan10) ← internal port, tagged VLAN 10
└── Linux Bridge (vmbr10) ← optional, for VM attachment
└── VM vNICs

Trunk mode optional These can run as simple access bridges or VLAN-aware bridges depending on how you configure them:

Linux Bridges
Physical NIC (eno1) ← trunk port on switch
└── Linux Bridge (vmbr0) ← VLAN-aware bridge
├── eno1 (uplink port, trunk)
├── VM vNIC (VLAN 10) ← tagged or untagged per port config
└── VM vNIC (VLAN 20) ← tagged or untagged per port config

OVS Bridges
Physical NIC (eno1) ← trunk port on switch
└── OVS Bridge (ovsbr0) ← single bridge, all VLANs
├── eno1 (uplink port, trunk)
├── VM vNIC (port tagged VLAN 10)
├── VM vNIC (port tagged VLAN 20)
└── VM vNIC (trunk port, multiple VLANs)

Access-mode switch port connections:

A Linux Bridge itself can have multiple IP addresses (small configuration with management and corosync on the same bridge for example).

Physical NIC (eno1) ← access port on switch (single VLAN)
└── Linux Bridge (vmbr0) ← simple bridge, no VLAN awareness
├── eno1 (uplink port)
├── VM vNIC (VM1)
└── VM vNIC (VM2)

vmbr0 ← bridge interface itself gets IPs
├── 192[.]168[.]10[.]1/24 ← primary IP (host management)
└── 192[.]168[.]10[.]2/24 ← secondary IP (additional host service)

An OVS Bridge is different than a Linux Bridge in that while OVS is just a Layer-2 virtual switch, you can't assign an IP directly to the OVS bridge itself, you need an OVS IntPort for that.

Physical NIC (eno1) ← access port on switch (single VLAN)
└── OVS Bridge (ovsbr0) ← single broadcast domain
├── eno1 (uplink port)
├── OVS IntPort (ovsbr0-mgmt) ← internal interface exposed to kernel
│    ├── 192[.]168[.]10[.]1/24 ← primary IP
│    └── 192[.]168[.]10[.]2/24 ← secondary IP alias
├── VM vNIC (VM1)
└── VM vNIC (VM2)

A Linux Bond or an OVS Bond can connect using Access Mode or Trunk Mode.

Get this one decision right before you touch anything else, and the rest of your Proxmox network config starts to make a lot more sense.