Networking

Quantix gives virtual machines software-defined networks that span every host in the datacenter. You manage them in the QvDC dashboard under Networking. Each host's physical interfaces, bridges, VLAN ports and bonds are managed on the host itself, in the Host UI.

Network types

Type	Use it when
VLAN Network	VMs should sit on an existing VLAN of your physical network. Traffic leaves the host tagged with the VLAN ID.
Overlay Network	VMs on different hosts need a private network that your physical switches do not have to know about. Traffic between hosts is encapsulated (Geneve).
External Network	VMs should connect directly to a physical network without tagging.
Isolated (Networking Wizard only)	VMs only talk to each other; no uplink to the physical network.

Prerequisites

• QvDC with at least one host added (see Add hosts to QvDC).
• A user with network management permission (the admin or System administrator role; see Users and roles).
• For VLAN and External networks: the host uplinks are cabled to switch ports that carry the VLANs you need.

Set up networking with the wizard

For a first network, the Networking Wizard walks through everything in one place and writes nothing until the last step.

1. Go to Networking and click Networking Wizard.
2. Goal & host uplinks — choose External, Overlay (recommended), VLAN or Isolated, and check the uplink NIC and bridge the wizard proposes for each host.
3. SDN / OVN chassis — the wizard prepares every host to carry virtual networks.
4. Virtual network — enter the Subnet (CIDR) and Gateway (and the VLAN ID for a VLAN network). Choose the DHCP source:
   • Existing DHCP on my LAN (default) — your network's DHCP server hands out addresses;
   • Managed by Quantix — Quantix serves DHCP; set the DHCP range and DNS servers.
5. Security baseline — add the inbound rules VMs on this network need. Quick rules are offered for SSH (22), RDP (3389), HTTP/HTTPS and Ping (ICMP).
6. Review & apply — check the plan and apply it.

Expected result: the new network appears on the Virtual Networks tab with Status healthy and Realized on listing every host.

Create a virtual network directly

1. Go to Networking → Virtual Networks and click New network.
2. Network Type — choose VLAN Network, Overlay Network or External Network.
3. Basic Info — enter a Network Name (up to 64 characters) and an optional Description.
4. Configuration:
   • VLAN ID (VLAN networks, 1–4094);
   • Network CIDR, for example 198.51.100.0/24 — the Gateway is suggested as the first address;
   • MTU — leave blank for automatic;
   • DHCP Server — off by default. Turn it on only if nothing else on that network serves DHCP; two DHCP servers on one network hand out conflicting addresses.
5. Review, then click Create Network.
6. If you turned DHCP on, open the network, go to Subnet & DHCP → Edit and set Pool start, Pool end and Lease time (hours), then Save changes.

Expected result: the network is listed with its CIDR, gateway and DHCP state, and can be chosen for VM network adapters.

To set the DNS resolvers handed to VMs, open the network, go to DNS → Edit and enter Resolvers separated by commas.

Connect a VM to a network

• When creating a VM — in the Networking step, each entry under Network Adapters needs a Network. Click Add NIC for more.
• On an existing VM — open the VM, go to its Network tab:
  • Add NIC opens Add Network Interface: choose the Network, a Security Group, and the NIC Model (VirtIO is the default and the fastest; use E1000 for guests without VirtIO drivers);
  • Change network moves an adapter to another network — live when possible, otherwise at the next power cycle;
  • Disconnect / Reconnect unplugs a running VM's adapter without removing it.

Security groups

Security groups are firewalls applied to VM network adapters. They are allow-lists: traffic that no rule allows is blocked, so a group with no rules blocks everything.

1. Go to Networking → Security and click New Security Group.
2. Enter a Name and Description, and pick Starter rules:
   • Baseline — all outbound allowed, inbound denied;
   • Remote admin — Baseline plus inbound SSH (22) and RDP (3389);
   • Web server — Baseline plus inbound HTTP (80) and HTTPS (443);
   • No rules — blocks all traffic.
3. Expand the group and use Add Rule under Inbound Rules or Outbound Rules. Set Action (Allow, Drop — discard silently, or Reject — reply with an error), Protocol, Port (from) / Port (to), and the Source CIDR (inbound) or Destination CIDR (outbound). 0.0.0.0/0 means any address.
4. Click Attach to apply the group to Virtual machines (all their adapters) or Virtual networks (the default for every adapter on that network that has no group of its own), then Save.

Expected result: the group's Protected VMs count rises, and the network's Security tab lists the groups in force.

VPN access

Networking → Services → VPN Services creates a WireGuard VPN so remote users can reach a virtual network. It runs on a Connector (created under Networking → Connectors → New Connector).

1. Click New VPN Service. Enter a Name, choose where to Deploy on, and how clients reach it — Quantix Relay (recommended) or Direct WireGuard with a Public endpoint such as vpn.example.com:51820.
2. Choose the Network clients will reach and, optionally, restrict Allowed IPs for clients. Click Create VPN Service.
3. Open the service and use Add Client. Let Quantix Generate a key for me, or paste the public key of a client that already has one.
4. Give the client its configuration with Show QR (for phones) or Download .conf.

Host networking (Host UI)

Each host's physical networking is under Networking → Physical Networking in its Host UI (https://<host-address>:8443/).

• Interfaces — Configure IP, Attach / Detach an uplink, or take a link down. Any change that moves the management address is checked: if the gateway stops answering, the host restores the previous setting within 10 seconds.
• Create Bridge — a Bridge Name and the Physical Interfaces to add.
• Bridges & VLANs → Add VLAN Port — Port Name, OVS Bridge, VLAN Mode (Access, Trunk or Native Untagged), VLAN Tag or Trunk VLANs.
• Bridges & VLANs → Create Bond — combine interfaces for redundancy or bandwidth. Bond Mode: LACP (802.3ad) (needs matching switch configuration), Active-Backup or Balance SLB.
• DNS & Identity — the host's hostname and DNS servers.

Troubleshooting a network

Networking → Diagnostics traces a packet through the virtual network: enter the Source logical port, Source IP, Destination IP, Protocol and Dst port, and click Run ovn-trace. The result shows which rule or router dropped or forwarded it. See also Troubleshooting.