# Networking

## Required separation

Keep these on logically separate networks/VLANs, ideally separate NICs:

- **Management** — web UI (8006), SSH
- **Corosync** — cluster quorum. Low, *consistent* latency (well under
  5ms) matters more than bandwidth. Never share with VM/storage traffic.
- **Ceph public** — VM-to-OSD traffic (once Ceph is live)
- **Ceph cluster/backend** — OSD-to-OSD replication, heaviest load

## Practical layout

2x 10/25GbE bonded or split:

- Link pair A → Ceph (public + backend, or split further if 4 NICs
  available)
- Link pair B → management + corosync + VM traffic, with corosync on its
  own VLAN even when sharing a physical NIC with the rest

## Cluster join requirements

- All nodes reachable to each other on SSH (22) and the corosync network
- Same PVE version across nodes
- NTP-synced clocks

## Firewall

Proxmox's built-in firewall operates at datacenter and node level.
Default-deny, then whitelist:

- SSH from the management network/VLAN only
- Web UI (8006) from the management network/VLAN only
- Corosync ports between cluster nodes
- Ceph ports between cluster nodes (once Ceph is live)

Enforce the network separation above at the firewall — corosync and Ceph
traffic shouldn't be reachable from the VM network even if they end up
sharing a physical link.

See `config/pve-firewall/` for a starting rule set.