This article serves as a comprehensive reference for engineers managing the SDE Network, detailing settings across unit environments, admin pages, and firewall rules. It includes instructions for configuring network settings, custom rules, and admin page tabs.
Every setting for SDE Network: the sde-network unit's environment, related settings in other units, the bootstrap script, the admin page's dialogs and the firewall rules that are always on.
Applies to: the sde-network unit and its admin page at /sde-network/ · Audience: engineers deploying and running SDE · Time: reference
1. Unit environment
File: /var/glitch-units/sde-network/glitch/config/enviroment. sde-install core writes it. After a change, recreate the unit: gl -d sde-network && gl -s sde-network. A value of __SET_ON_HOST__ counts as not set. The admin page's Settings tab shows the values in use.
Admin page
Setting
What it does
Default
Notes
SDE_NETWORK_GUAC_URL
Guacamole, for admin sign-in. Only Guacamole administrators may sign in.
Not set: sign-in is off
sde-install sets http://guacamole:8080
SDE_NETWORK_SHARED_SECRET
Secret for scripts and the gateway calling the admin API (header X-SDE-Network-Secret).
None: the unit won't start without it
16 characters or more. openssl rand -hex 32. The gateway's SDE_NETWORK_SECRET has the same value.
Comma-separated. Addresses in SDE_GUEST_NETWORKS are always refused.
SDE_NETWORK_LISTEN
Address and port the unit listens on.
:8099
nginx reaches it as sde-network:8099 on the sde docker network.
SDE_NETWORK_DATA
Data folder inside the container: state, revisions, change log, SSH key, backups.
/opt/sde-network/data
Mapped to data/state on the host, owned by uid 1001, mode 700.
SDE_NETWORK_RECONCILE
How often the unit checks the zone, VNets and edge, and puts back what drifted.
60s
Less than 15s is treated as 60s.
Address block and zone
Setting
What it does
Default
Notes
SDE_NETWORK_BLOCK
The address block every network's subnet comes from. NAT applies to traffic from it.
10.250.0.0/16
IPv4, /23 or larger. Must not overlap the LAN or anything your firewall routes. GLServer needs a route to it via the edge.
SDE_GUEST_NETWORKS
Addresses that are never "internal" to any SDE admin page or API.
Not set (a warning in the log)
Same value as the block, in every SDE unit. sde-install sets it.
SDE_NETWORK_ZONE
The Proxmox SDN zone's ID.
sde
Up to 8 lower-case letters and digits. Rarely changed.
SDE_NETWORK_MTU
MTU offered in the Set up dialog, sent to guests by DHCP and set on the edge's network cards.
1450
1450 suits a 1500-byte underlay (VXLAN adds 50 bytes). The zone uses the dialog's value, so keep the two the same.
SDE_NETWORK_VNI
VXLAN IDs given to networks.
25000-25999
A range low-high, 1–16777215.
SDE_NETWORK_ZONE_USERS
Proxmox users SDE Network allows to use its zone (SDN.Use), so they can put guests on networks.
sde-vdi@pve,sde-vapps@pve
Comma-separated Proxmox users.
Edge router
Setting
What it does
Default
Notes
SDE_NETWORK_EDGE_IP
The edge's LAN address, with prefix.
Not set: SDE Network stays idle
For example 10.20.0.19/24. Free, outside the LAN's DHCP range, outside the block.
SDE_NETWORK_EDGE_GATEWAY
The LAN's gateway: the edge's default route.
Not set
sde-install offers GLServer's default gateway.
SDE_NETWORK_GLSERVER_IP
GLServer's LAN address: SDE's way in to guests and theirs to SDE.
Not set
sde-install sets it to the host it runs on.
SDE_NETWORK_EDGE_TEMPLATE
VM ID of the router template.
6899
Built by pve-bootstrap-sde-network.sh --edge-template.
SDE_NETWORK_EDGE_VMID
VM ID for the edge router.
6900
SDE_NETWORK_EDGE_NODE
Node the edge runs on.
The template's node
SDE_NETWORK_EDGE_STORAGE
Storage for the edge's disk.
The template's storage
The token needs rights on it (bootstrap --storage).
Active Directory and DNS
Setting
What it does
Default
Notes
SDE_NETWORK_AD_DOMAIN
AD DNS domain. The edge forwards it to the DCs and gives it to guests as their DNS suffix.
Not set: no AD
For example lab.local. sde-install copies the gateway's SDE_LDAP_UPN_SUFFIX.
SDE_NETWORK_DCS
Domain controllers guests may reach on the AD ports.
Not set: no AD rules
Comma-separated IPv4 addresses. sde-install doesn't set it.
SDE_NETWORK_DNS
Upstream DNS for all other names.
The DCs
Comma-separated IPv4 addresses. Set it on a site without AD.
Proxmox
Setting
What it does
Default
Notes
SDE_NETWORK_PVE_URL
Proxmox API addresses.
Not set: the unit is idle
Comma-separated, one per node, for example https://10.20.0.12:8006,https://10.20.0.13:8006. The bootstrap script prints it.
SDE_NETWORK_PVE_TOKEN_ID
API token ID.
Not set
sde-network@pve!network
SDE_NETWORK_PVE_TOKEN_SECRET
API token secret.
Not set
Shown once by the bootstrap script.
SDE_NETWORK_PVE_POOL
Proxmox resource pool for the edge and its template.
sde-network
SDE_NETWORK_PVE_CA_FILE
Proxmox's CA certificate, to trust the API's certificate.
Not set
For example /opt/sde-network/data/pve-root-ca.pem (copy of a node's /etc/pve/pve-root-ca.pem).
SDE_NETWORK_PVE_INSECURE
Accept any certificate from Proxmox.
false
Test sites only.
2. Settings in other units
Setting
What it does
Default
Notes
SDE_GUEST_NETWORKS (every SDE unit)
Guests at these addresses are never trusted as "internal" by sde-gateway, sde-vdi, sde-vapps, sde-redirector or sde-network.
Not set
The address block. sde-install sets it in each unit; sde-install check checks it.
SDE_NETWORK_URL (sde-gateway)
Where the usage report reads the network map.
Not set: no Network map tab
http://sde-network:8099
SDE_NETWORK_SECRET (sde-gateway)
Secret for that call.
Not set
Same as SDE_NETWORK_SHARED_SECRET.
SDE_VDI_NETLOGON_KERBEROS (sde-vdi)
true keeps Windows' Kerberos-based Netlogon secure channel when joining desktops.
false: the classic channel (UseKerberosForSecureChannels=0)
Leave it off for desktops on SDE Networks.
sde-network-route service (GLServer)
GLServer's route to the block via the edge (ip route replace).
Written by sde-install
/etc/systemd/system/sde-network-route.service. netplan is left alone.
3. Bootstrap script options
scripts/network/pve-bootstrap-sde-network.sh, run as root on a Proxmox node.
Setting
What it does
Default
Notes
(no option)
Creates the pool sde-network, the roles SDENETWORK and SDENETWORKACL, the user sde-network@pve, its token (privilege separation off) and the permissions; prints the unit's lines.
Safe to run again.
--storage S
Storage for the edge's disk. Repeat for several.
Every storage that holds disk images
With --edge-template: the template's disk storage (default: the first that holds disk images).
--rotate-token
Deletes and recreates the token, and prints the new secret.
Not with --check.
--edge-template
Builds the router template on this node.
VM 6899sde-edge-tpl-d12
Downloads the Debian 12 genericcloud image (checksum checked).
--node N
Node for the template.
This node
Must be this node.
--bridge B
LAN bridge for the template's first card.
vmbr0
--vmid ID
Template's VM ID.
6899
Set SDE_NETWORK_EDGE_TEMPLATE to match.
--check
Reports OK or FIX for each item, the nodes' addresses and the firewall state. Changes nothing.
No ACL on /vmsA permission on a more specific path replaces what the user inherits there. Don't add one for sde-network@pve on /vms: it would replace PVEAuditor and hide VMs from the map.
4. Set up dialog
Overview → Set up…
Setting
What it does
Default
Notes
One field per node
That node's VXLAN address (the zone's peers).
The node's cluster address
The network that carries UDP 4789 between nodes, usually the cluster network.
MTU inside the networks
The zone's MTU.
1450 (or an existing zone's)
1280–8950. Keep it the same as SDE_NETWORK_MTU.
5. Network settings
Networks → New network, or the pencil icon on a card.
Setting
What it does
Default
Notes
Name
The network's name, also the VNet's alias in Proxmox.
Required
1–48 letters, digits, spaces and . , _ ( ) & ' -, starting with a letter or digit. Unique.
Description
Shown on the card.
Empty
Up to 200 characters.
Subnet
The network's addresses. The edge is .1.
The next free /24 in the block
/16 to /28, inside the block, not overlapping another network. Fixed once created.
DHCP range
Addresses DHCP gives out.
.100–.250 on a /24; on other sizes, from a quarter of the way in to the second-last address
Inside the subnet, start first, not including .1, the network or the broadcast address.
Access
Isolated, Internet or Custom.
Isolated
See the table below.
Keep guests apart
Machines on this network can't reach each other, only the edge and beyond.
Off
Proxmox VE 8.3+, datacenter firewall on, nftables on every node.
Reserved addresses
Fixed DHCP addresses by MAC.
None
See section 7.
Access mode
Adds to the built-in rules
Isolated
Nothing.
Internet
Guests to any address that isn't private (10.0.0.0/8, 100.64.0.0/10, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), NATed to the edge's address.
Custom
Your rules, in order. With no rules it's the same as Isolated. Rules are kept only in Custom mode.
6. Custom rules
In the network editor with Access set to Custom. First match wins; anything no rule allows is dropped. Rules apply to traffic leaving this network.
Setting
What it does
Default
Notes
Action
Allow or drop matching traffic.
allow
allow or deny
Protocol
Which traffic matches.
tcp
any, tcp, udp, icmp
Destination
Where the traffic goes.
Required
IPv4 addresses or networks, comma-separated; internet (any non-private address); or another network's ID such as sden0002 (not this network).
Ports
Destination ports.
Empty: all ports
443, 80,443, 8000-8100; 1–65535; tcp or udp only.
Description
Shown in the edge's rules.
Empty
Up to 60 characters: letters, digits, spaces and . , _ : / ( ) & + -
7. Reserved addresses
Setting
What it does
Default
Notes
MAC address
The guest's card.
Required
Like bc:24:11:aa:bb:cc. Each MAC once per network.
Address
The address it always gets.
Required
Inside the subnet; not .1, the network or the broadcast address. Each address once.
Host name
Name the edge's DNS gives the address.
Empty
Lower-case letters, digits and hyphens, up to 63 characters.
8. Built-in firewall rules
Always on, on every network, whatever the access mode. They can't be edited. Overview → Rules on the edge shows them as running, with counters. "Guests" means any SDE network; "GLServer" is SDE_NETWORK_GLSERVER_IP; "DCs" is SDE_NETWORK_DCS.
Through the edge
From
To
Protocol and ports
Action
Notes
Any
Any
Replies to allowed connections
Allow
Invalid packets are dropped.
GLServer
Guests
TCP 22, 3389; ICMP echo (ping)
Allow
Remote desktop (Guacamole, RD Gateway) and SSH (SDE vApps). Routed: guests see GLServer's address.
Guests
GLServer
TCP 443; ICMP echo
Allow
The portal, SDE Devices agents. Routed: SDE sees the guest's address.
Only when SDE_NETWORK_DCS is set. NATed to the edge's address.
Guests
DCs
UDP 53, 88, 123, 389, 464
Allow
As above. Ping to the DCs isn't allowed.
Guests
Internet
Any
Allow
Internet mode only (or a Custom rule).
Guests
Proxmox nodes, the LAN, other SDE networks, anything else
Any
Drop
Unless a Custom rule allows it. Counted as "dropped forward".
To the edge itself
From
To
Protocol and ports
Action
Notes
Guests
Edge (.1)
UDP 53, 67; TCP 53
Allow
DHCP and DNS.
GLServer
Edge (LAN address)
TCP 22
Allow
sde-network's management SSH. The key may only run the edge's apply command.
Any
Edge
ICMP echo
Allow
Any
Edge
Anything else
Drop
Counted as "dropped input".
Address translation
Traffic
Source address seen
Guests to GLServer
The guest's own address (routed)
Guests to anything else on or beyond the LAN (DCs, internet, allowed servers)
The edge's LAN address (NAT)
Traffic between guests on the same network doesn't pass the edge, so these rules don't apply to it. Use Keep guests apart to stop it.
9. Keep guests apart rules
Written on the VNet's Proxmox firewall (forward direction, every node) when Keep guests apart is ticked. Each has a comment starting sde-network:. The VNet's policy stays ACCEPT and other rules on the VNet are left alone.
Rule
Action
From or to the edge (.1)
Accept
Subnet to subnet
Drop
IPv6 link-local
Drop
10. Limits and fixed values
Item
Value
Networks per edge
31
Custom rules per network
100
DHCP lease time
12 hours
DHCP options sent
Router and DNS = .1, domain and search domain (with AD), MTU
VNet IDs
sden0001, sden0002…
Edge router VM
Debian 12, 1 core, 512 MB, 4 GB disk, named sde-edge, in pool sde-network
Revisions kept
50, in the unit and on the edge
Daily backups kept
14
Activity shown
The most recent 500 changes
Admin sign-in lasts
8 hours
11. Admin page tabs
Tab
What's there
Overview
Networks, zone, edge router and rules revision; each node's zone status; Set up…, Repair, Rules on the edge, Remove SDE Network…. Warns about VNets in the zone that SDE Network doesn't manage.
Map
The network map.
Networks
A card per network: edit, delete, Guests and leases.
Changes
Revisions: View, Roll back.
Activity
Change log.
Readiness
Live checks: Proxmox token and privileges, same versions on every node, router template and address, zone on every node, SDE VDI and SDE vApps rights, edge running and up to date, GLServer's route, guest isolation, room for more networks. Changes nothing.
Settings
Backup (download, restore) and the values from the unit's environment (read-only).
