How to Configure the Proxmox Network Bridge vmbr0

Every Proxmox install ends up with an interface called vmbr0, and every new user eventually has to understand it. It’s the reason your VMs can talk to the network — or the reason they can’t, when something’s misconfigured. Getting comfortable with it removes most Proxmox networking headaches.

This guide explains what vmbr0 actually is, how the config file works, how to attach VMs to it, how to add a second bridge for isolated or NAT networks, and the handful of mistakes that leave VMs with no internet. The examples target Proxmox VE 8.x, which uses ifupdown2 so you can apply network changes without rebooting.

What vmbr0 actually is#

vmbr0 is a Linux bridge, and the cleanest way to picture it is a network switch that lives inside your server. A physical switch has ports; you plug devices in and they all share the same network. A Linux bridge does the same thing in software.

Here’s how the pieces connect on a default install:

• Your physical NIC (something like enp3s0 or eno1) is plugged into the bridge as a bridge port. It’s the uplink — the cable to the outside world.
• vmbr0 is the bridge itself. The host’s management IP usually sits here.
• Each VM gets a virtual network card that’s also plugged into vmbr0.

Because everything shares the bridge, your VMs appear on the physical network as if they were separate machines plugged into your real switch. They get IPs from the same DHCP server (or you set static ones), and they’re reachable from other devices on the LAN.

Reading /etc/network/interfaces#

Proxmox stores its network config in /etc/network/interfaces, plain text in Debian’s ifupdown format. A standard single-NIC install looks like this:

auto lo
iface lo inet loopback

iface enp3s0 inet manual

auto vmbr0
iface vmbr0 inet static
    address 192.168.1.50/24
    gateway 192.168.1.1
    bridge-ports enp3s0
    bridge-stp off
    bridge-fd 0

Read it line by line and the design is clear:

The bridge-ports line is the one people get wrong. It names the physical NIC that connects the bridge to your real network. If it’s blank or points at the wrong interface, the bridge exists but has no way out, and every VM on it goes dark.

Attaching a VM to the bridge#

When you create or edit a VM, its network device points at a bridge. In the VM’s Hardware → Network Device, the Bridge dropdown is where you choose vmbr0.

That’s usually all it takes. The VM gets a virtual NIC on the bridge, behaves like a physical machine on your LAN, and pulls an IP from DHCP or uses a static one you set inside the guest.

If your network uses VLANs, set the VLAN Tag on the VM’s network device and make sure vmbr0 is created VLAN-aware (a checkbox on the bridge in the GUI, or bridge-vlan-aware yes in the config). A VLAN-aware bridge tags the VM’s traffic so it lands on the right VLAN without needing a separate bridge per VLAN.

auto vmbr0
iface vmbr0 inet static
    address 192.168.1.50/24
    gateway 192.168.1.1
    bridge-ports enp3s0
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 2-4094

Adding a second bridge#

One bridge covers most setups, but a second is useful when you want an isolated network — say a DMZ, a lab segment, or an internal-only network where VMs talk to each other but not the LAN.

If you have a second physical NIC, bridge it the same way as the first:

auto vmbr1
iface vmbr1 inet manual
    bridge-ports enp4s0
    bridge-stp off
    bridge-fd 0

Notice there’s no address line here — this bridge is just for VMs, so the host doesn’t need an IP on it. Assign VMs to vmbr1 exactly as you did with vmbr0.

For an internal-only bridge with no physical uplink (VMs can reach each other and the host, but not the outside world unless you set up routing), leave bridge-ports empty:

auto vmbr1
iface vmbr1 inet manual
    bridge-ports none
    bridge-stp off
    bridge-fd 0

To give that internal network internet access, you’d put an IP on the host side of vmbr1 and add NAT rules with iptables or nftables — a routed setup that’s the standard answer when the host only has Wi-Fi or a single public IP.

Applying changes without a reboot#

After editing the config, apply it. On Proxmox VE 7 and later (which use ifupdown2), you don’t need to reboot:

# apply all interface changes from /etc/network/interfaces
ifreload -a

If you made the change in the GUI, click Apply Configuration on the Network page instead. To check the result:

# list interfaces and their addresses
ip a

# show which ports belong to which bridge
brctl show 2>/dev/null || bridge link

Why VMs end up with no internet#

This is the problem that brings most people to this page. When a Proxmox VM can’t reach the network, it’s almost always one of these, roughly in order of how often they happen:

Work through it from the outside in. First confirm the host itself has internet (ping 1.1.1.1 from the Proxmox shell). If the host is fine but the VM isn’t, the problem is between the VM and the bridge: check which bridge the VM is on, then check the network settings inside the guest OS.

Putting it together#

vmbr0 is just a virtual switch: a physical NIC as the uplink, the host’s IP on the bridge, and VMs plugged in alongside it. Once that model clicks, the config file reads naturally and most “no internet” problems become a quick checklist instead of a mystery.

If you’re setting up a host from scratch, the bare-metal install guide shows where vmbr0 first gets created, and the Proxmox VE vs VMware ESXi comparison covers how the platform fits overall. For more, browse the Proxmox guides.