Detailed write-up on my VMware vSphere 7 nested homelab networking setup

Detailed write-up on my VMware vSphere 7 nested homelab networking setup

I have been getting quite a few inquiries about my fully nested VMware homelab setup. People seem to be struggling mostly with setting up the networking bits. I describe the overall topology in this blogpost but this blogpost will contain a lot more details on the network configuration. I also made a couple of changes, such as replacing the pfSense appliance with a Vyos appliance and the introduction of NSX-T (although this doesn’t change anything to my physical network configuration). I will use as many screenshots as possible to create a step by step process.

Update Video Tutorial

To answer some of the questions I received about my configuration, I recorded a video tutorial on setting up a nested homelab:

VMware vSphere 7 Nested Homelab Networking Setup Video Tutorial

The physical ESXi host

I’m using a Supermicro SYS-5028D-TN4T server. It has 4 physical NICs and an IPMI port but since my lab is running fully nested, I use only a single NIC. I even shared the IPMI on the NIC so I can save a port on my switch.

Routing between physical and nested with a Vyos appliance

My home network is just a simple flat networking running in with my ISP router being the default gateway to the internet.

I use a Vyos appliance to route between my physical homelab and all the VLANs I use in my homelab environment. I configured two NICs on the appliance. One NIC is connected to my physical home network (the uplink) and the other NIC is connected to my homelab environment:

If you look at the interface configuration you will see interface eth0 configured with and eth1 is subdivided in multiple vif interfaces. These are subinterfaces for all my routable VLANs:

My ESXi management network for my homelab is VLAN 1611 with subnet for example. That VLAN is routed by a VIF 1611 on the Vyos appliance with IP address That’s the default gateway for VLAN 1611. The Vyos router holds a route to my ISP router by the way.

How to enable VLANs on ESXi

For the nested environment to support the use of VLANs, we need to take a couple of steps on the physical ESXi host network configuration. If we look at the physical NICs we see the single attached 1000Mbps interface. The other 3 NICs are disconnected:

First of all, we need two vSwitches:

The first switch has a single uplink (the only configured physical NIC on the Supermicro). This vSwitch holds two portgroups:

  1. The management vmkernel port so I can reach the physical ESXi host from my home network. This management interface is configured with the IP address and default gateway
  2. A Virtual Machine portgroup to hold all the VMs that run inside my home network These are my Windows AD / Jumphost, a Linux jumphost and the uplink interface of the Vyos appliance:

Really straightforward. The second vSwitch is where the VLAN magic happens. This is a vSwitch without any uplinks. The Vyos appliance connects the first vSwitch with the uplink to the physical network to the VLANs on this isolated vSwitch. The isolated vSwitch only has two Virtual Machine portgroups:

  1. Nested-ESXi
  2. ESXi-Mgmt

The magic of VLAN 4095

The Nested-ESXi switch is configured with VLAN 4095. This basically turns it into a VLAN trunk port. This means it now supports guest VLAN tagging. I can now create a management interface on a nested ESXi server and tag it with VLAN 1611 on the nested ESXi host itself. The ESXi-Mgmt is a basic portgroup with VLAN 1611 because I want to run some VMware appliances directly on the physical ESXi host and not on one of my nested ESXi hosts (such as vCenter Server, NSX-T Manager and the NSX-T Edge). They need access to the ESXi Management network VLAN 1611 so that’s why I needed to create that VLAN backed portgroup on the physical host as well. I can imagine this is where it becomes a bit fuzzy.

Additional screenshots

I will walk you through the setup in a couple of steps / screenshots.

The Nested-ESXi vSwitch:

Pay special attention to the MTU 9000 and security settings configuration (allow promiscuous, forged transmits and MAC changes)

Next up is the Nested-ESXi portgroup configuration:

Configuring VLAN 4095 on this port group is essential to enable VLAN support in a nested homelab. Also ensure you enable the required security settings to support nested virtualization:

The ESXi-Mgmt port-group to support VMs running on the physical ESXi host in VLAN 1611:

My Windows jumphost has IP address and is using the Vyos router with as its default gateway. The route to (my ISP router) enables internet access:

Nested vCenter and ESXi

I deployed vCenter Server on the physical ESXi host and deployed four nested ESXi hosts with 32GB RAM and 16 CPUs in a single cluster. Heavily oversubscribed of course but this does allow me to run nested applianced with a high CPU and RAM count demand. Logging into vCenter Server and taking a closer look to the network setup there:

vCenter holds one Distributed Switch with two uplinks (the other two uplinks are for NSX-T) and a number of portgroups:

  • ESXi Management VLAN 1611
  • vMotion VLAN 1612
  • vSAN VLAN 1613
  • Overlay VLAN 1615
  • Uplink 01 VLAN 50 (VLAN between NSX-T and the Vyos for north/south traffic)
  • Uplink 02 VLAN 60 (VLAN between NSX-T and the Vyos for north/south traffic)

I can configure MTU 9000 wherever I like because the underlying vSwitch on the physical ESXi host is also running MTU 9000. Some screenshots:

The ESXi Management portgroup with VLAN 1611:

The network topology from the perspective of a nested ESXi host:

The configuration of the VMkernel interfaces on a nested ESXi host (don’t forget to set the proper MTU here too):

What about NSX-T?

And that’s it for now :-). I’m currently rebuilding my nested homelab configuration with vSphere 7.0 with Kubernetes and NSX-T 3.0. This is taking a bit longer due to a lack of time but I will be sure to blog about those adventures too. Make sure you stay tuned!

If you have any questions about this nested setup, you know how to reach me (best on Twitter).

7 thoughts on “Detailed write-up on my VMware vSphere 7 nested homelab networking setup”

  • 1
    vlab athomas3 on June 1, 2020 Reply

    Honestly there are lots of gaps in this.
    It gives no one a clue how you deployed your esx’s inside that 1611 VLAN as per this post
    From that jumpbox you created its not possible to deploy this vCenter.
    Can you elaborate the networking section The magic of VLAN 4095 section with more pictures.
    I’ve tried this exactly as you did and i see no result.

    • 2
      vlab athomas3 on June 1, 2020 Reply


    • 3
      jkusters on August 28, 2020 Reply

      I missed your question, sorry.

      I’m not sure which part you are missing. You just configure the management vmkernel with VLAN1611 (via the management console for example). The jumpbox is in my home netwerk and has a routed connection to my management VLAN. The vyos router takes care of this with the uplink connected to my home network and vif interfaces for my VLANs.

  • 4
    forbzie on June 16, 2020 Reply


    I have my homelab setup exactly the same way so far although i use pfsense for the VLAN’s.
    When will you be posting the install & configure part of NSX T version 3 ?
    I’m keen to understand how you setup the transport zones, node profiles and gateways etc….

  • 5
    Shetu on August 28, 2020 Reply

    How can I use this method for pfsense vm?

  • 7
    jkusters on September 2, 2020 Reply

    I’ve added a video tutorial to this blogpost to provide some additional details…

Leave a Reply