Running Proxmox on IONOS with private networking, VLAN and multiple public IPs? WZ-IT handles setup, network design, operations and support for your Proxmox infrastructure. View Service Page →
The key to a stable IONOS setup is a clean private backend network. Without it, Corosync or storage runs over public IPs. Yet IONOS describes very clearly how to build a private network for Dedicated Servers: via tagged VLANs according to IEEE 802.1Q (IONOS Docs).
Table of Contents
- Proxmox needs separate networks: IONOS Private Networks
- What Does "tagged VLAN (802.1Q)" Mean at IONOS?
- Reference Architectures
- Set up IONOS Private Network and VLAN: step by step
- Common Mistakes and How to Avoid Them
- Our Approach at WZ-IT
- Related Guides
Proxmox needs separate networks: IONOS Private Networks
Proxmox recommends a separate Corosync network; storage should not be on the same network as Corosync, the only exception is a low-priority fallback link in a redundant configuration (network requirements).
IONOS provides the technical foundation for Dedicated Servers to build a private network: tagged VLANs (IEEE 802.1Q) (IONOS Docs).
What Does "tagged VLAN (802.1Q)" Mean at IONOS?
A private network of Dedicated Servers can be created by configuring tagged VLANs. VLANs are standardized in IEEE 802.1Q (IONOS Docs).
IONOS has OS-specific guides:
- AlmaLinux/Rocky: VLAN trunk (802.1Q) (IONOS Docs)
- Ubuntu/Debian: tagged VLAN for private network (IONOS Docs)
Practically this means:
- Read the assigned private network VLAN ID in the IONOS account.
- The interface becomes VLAN-aware, and traffic is logically separated
- You can build a "backend" that doesn't route publicly
Reference Architectures
These patterns are architecture sketches. For B and C, first confirm with IONOS whether one server can belong to multiple private networks simultaneously.
Pattern A: Single Node (Dedicated)
For whom: Small to medium setups, cost focus, "just get started".
Networks:
- Public: only what's really necessary (e.g., services)
- Private/VLAN: Management (or just VPN/Bastion), optional backup backend
Goal: Fast, robust, operationally secure (backups/monitoring/updates).
Important: Single node ≠ HA. You need a plan for how to recover in case of hardware failure (RTO).
Pattern B: 3-Node Cluster (Recommended)
For whom: Real failover, maintenance without downtime, resilience.
Networks:
- Management VLAN
- Corosync VLAN (separate!) (Proxmox Admin Guide)
- Storage VLAN (if Ceph/storage-intensive), not shared with Corosync
Pattern C: "2 VLANs Are Often Enough" (small cluster without Ceph)
If no Ceph:
- VLAN A: Management
- VLAN B: Corosync; use a separate network with sufficient bandwidth for migration where possible.
But: As soon as storage becomes intensive, separate again.
Set up IONOS Private Network and VLAN: step by step
Step 1: Create a private network and read its VLAN ID
This guide covers dedicated servers managed in Cloud Panel. Create a private network in the IONOS account and assign the servers. Read its VLAN ID under Servers & Cloud, Infrastructure, Servers, Private Networks. Then plan private IP addresses and VPN access.
Step 2: Configure VLAN/802.1Q on Dedicated Servers (IONOS Guides)
IONOS documents this as step-by-step per OS:
- AlmaLinux/Rocky: VLAN Trunk (802.1Q) for private network (IONOS Docs)
- Ubuntu/Debian: tagged VLAN for private network (IONOS Docs)
Important (Real-Life): If VLAN module/802.1Q is not correctly loaded, it won't work (IONOS mentions this in their troubleshooting notes).
You can check whether the 802.1Q module is loaded like this:
lsmod | grep 8021q || modprobe 8021q
Step 3: Properly Assign Proxmox Bridges
- Management Bridge on Management VLAN
- Corosync Interface/Bridge on Corosync VLAN
- Storage Interface/Bridge on Storage VLAN (if needed)
A VLAN-aware bridge with tagged subinterfaces looks like this in /etc/network/interfaces (Proxmox docs):
# eno1 must be the interface specified for the Private Network.
# 3509 is only the IONOS documentation example: replace with your account VLAN ID.
auto vmbr1
iface vmbr1 inet manual
bridge-ports eno1
bridge-stp off
bridge-fd 0
bridge-vlan-aware yes
bridge-vids 3509
auto vmbr1.3509
iface vmbr1.3509 inet static
address 10.10.20.11/24
Step 4: Really Run Corosync Separately
Proxmox recommends a separate cluster network; storage should not run in the Corosync network, the only exception is a low-priority fallback link in a redundant configuration (network requirements).
That's your guardrail when defining VLANs.
When creating the cluster, bind Corosync explicitly to the IP in the Corosync VLAN (Proxmox docs):
# Node 1:
pvecm create CLUSTERNAME --link0 10.10.20.11
# Node 2 (Join):
pvecm add 10.10.20.11 --link0 10.10.20.12
Step 5: Validation & Tests
After setup (before production):
- Corosync stable under load?
- Storage recovery doesn't affect Corosync?
- Migration runs over a network with bandwidth (and not over Corosync) - Proxmox VE uses the cluster communication network for migration by default; the
migrationparameter defines a separate network as a CIDR (Proxmox Admin Guide: Migration Network)
Common Mistakes and How to Avoid Them
Mistake 1: "VLAN planned, but not implemented end-to-end"
One node has the assigned VLAN ID, the other doesn't → "works weird".
Fix: VLAN plan + consistent OS config everywhere.
Mistake 2: 802.1Q Module Missing / Wrong Kernel
IONOS explicitly mentions that 802.1Q module availability can be an error cause (IONOS Docs).
Fix: Load module / check kernel.
Mistake 3: Corosync + Storage in Same VLAN
No, Proxmox advises against it; the only exception is a low-priority fallback link in a redundant configuration (network requirements).
Fix: Separate Storage VLAN.
Mistake 4: Management Public
Unnecessary risk.
Fix: Bastion/VPN + Firewall, management only from private networks.
Mistake 5: Migration Kills Cluster Network
When migration runs over cluster network, Corosync can suffer (Proxmox Admin Guide: Migration Network).
Fix: Migration on "fat pipe" VLAN.
Our Approach at WZ-IT
For Proxmox on IONOS, we proceed as follows:
- Requirements Analysis: Single node vs. cluster, HA goals, storage requirements
- Network Design: IP plan, VLAN IDs from the account, interface assignment
- Setup: VLAN configuration (802.1Q), Proxmox installation with clean bridge assignment
- Hardening: Secure management, firewall, Bastion/VPN
- Validation: Corosync stability, failover tests, monitoring
- Documentation: Network plan, runbooks, escalation paths
We handle the complete setup or audit existing infrastructures.
View Service Page: Proxmox on IONOS →
Related Guides
For public connectivity and private guests: Proxmox on IONOS: private VM network behind one IP; Proxmox on IONOS: multiple public IPs and routing.
Sources
As of October 2026. The architecture sketches do not replace checking the specific IONOS server assignments.
