Interface and bridge notes

A quick overview on Debian/Ubuntu style systems:

#Add new vlan
vconfig add eth0 120

#Add a new bridge interface
sudo /usr/sbin/brctl addbr br0120

#Bind in a real interface
sudo /usr/sbin/brctl addif br0120 eth0.120

#Configure it for start up
vi /etc/network/interfaces

allow-hotplug eth0
allow-hotplug eth1.120

auto eth0
iface eth0 inet static
address 192.168.0.5
netmask 255.255.255.0
gateway 192.168.0.254

auto eth0.120
iface eth0.120 inet manual
vlan_raw_device eth0

auto br0120
iface br0120 inet static
 address 192.168.10.5
 network 255.255.255.0
 bridge_ports eth0.120
 bridge_stp off
 bridge_maxwait 0
 bridge_fd 0

# IPv6
iface eth0 inet6 static
address 2001:db8::xxxx:yyyy
netmask 64
gateway 2001:db8::xxxx:yy:zzzz


#Static routes
vi /etc/network/if-up.d/static-routes-eth0

#!/bin/sh
if [ "$IFACE" = "eth0" ]; then
    route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.0.50
fi

#Check ifstate for ifdown and ifup
cat /etc/network/run/ifstate 
lo=lo
eth0.120=eth0.120
br0120=br0120
eth1=eth1
eth0=eth0

A quick overview for CentOS/RHEL:

# Check/load the VLAN tagging module
lsmod | grep 802
sudo modprobe 8021q

# Make it persistent
echo "8021q" > /etc/modules-load.d/8021q.conf

# Creat a VLAN tagged interface for the OS (remember, the kernel always absorbs the outter most VLAN tag):
sudo vconfig add em2 501
Added VLAN with VID == 501 to IF -:em2:-
[[email protected] network-scripts]$ sudo cat /proc/net/vlan/config
VLAN Dev name    | VLAN ID
Name-Type: VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD
em2.501        | 501  | em2

# Make the VLAN interface persistent
# cat /etc/sysconfig/network-scripts/ifcfg-em2.501
TYPE=Ethernet
BOOTPROTO=static
IPV4_FAILURE_FATAL=no
IPV6INIT=no
IPV6_AUTOCONF=no
IPV6_FAILURE_FATAL=no
IPADDR=1.1.1.2
NETMASK=255.255.255.0
GATEWAY=1.1.1.1
DNS1=1.1.1.10
DNS2=1.1.1.20
DEFROUTE=yes
PEERDNS=yes
PEERROUTES=yes
NAME=em2.501
DEVICE=em2.501
ONBOOT=yes
NM_CONTROLLED=no
VLAN=yes
BRIDGE=br501


# Set up a bridge with the physical NIC
sudo brctl addbr br0
sudo brctl addif br0 em2

# To make it persistent
# cat /etc/sysconfig/network-scripts/ifcfg-br0
TYPE=Bridge
BOOTPROTO=none
DELAY=0
NM_CONTROLLED=no
NAME=br0
DEVICE=br0
ONBOOT=yes
STP=off

# cat /etc/sysconfig/network-scripts/ifcfg-em2
TYPE=Ethernet
BOOTPROTO=static
IPV4_FAILURE_FATAL=no
IPV6INIT=no
IPV6_AUTOCONF=no
IPV6_FAILURE_FATAL=no
NAME=em2
UUID=4f7acd96-97c6-49ea-9859-045c1857c758
DEVICE=em2
ONBOOT=yes
NM_CONTROLLED=no
BRIDGE=br0


# Create tagged VLANs on the bridge if a guest VM wanted tagged traffic for example, and not the OS
sudo vconfig add br0 503
Added VLAN with VID == 503 to IF -:br0:-
sudo vconfig add br0 504
Added VLAN with VID == 504 to IF -:br0:-
sudo ip link set up dev br0
sudo ip link set up dev br0.503
sudo ip link set up dev br0.504

sudo cat /proc/net/vlan/config
VLAN Dev name    | VLAN ID
Name-Type: VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD
br0.503        | 503  | br0
br0.504        | 504  | br0
em2.501        | 501  | em2

sudo brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.0ec608c9871f       no              em2

# To make the VLAN tagged bridge persisten
# cat /etc/sysconfig/network-scripts/ifcfg-br0.503
TYPE=Ethernet
BOOTPROTO=none
DELAY=0
NM_CONTROLLED=no
DEVICE=br0.503
ONBOOT=yes
VLAN=yes


# Adding a dummy interface...
# Check/load the dummy interface module
lsmod | grep dumm
sudo modprobe dummy

sudo ip link add name vnic21 type dummy
sudo ip link set up dev vnic21

When a VLAN tagged interface exists on a physical NIC the Linux kernel trips the outer most VLAN tag off. This means a VM bridged with a physical NIC tagged VLAN logical interface won't receive tagged frames. In such a case the physical NIC must be added to a bridge and the VLAN tags added to the bridge only:

# Set up a bridge with the physical NIC, add VLANs to the bridge not the physical NIC, this NIC receives VLAN "tagged" outside traffic from different networks:
sudo brctl addbr br0
sudo brctl addif br0 em2
sudo vconfig add br0 503
Added VLAN with VID == 503 to IF -:br0:-
sudo vconfig add br0 504
Added VLAN with VID == 504 to IF -:br0:-
sudo ip link set up dev br0
sudo ip link set up dev br0.503
sudo ip link set up dev br0.504

sudo cat /proc/net/vlan/config
VLAN Dev name    | VLAN ID
Name-Type: VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD
br0.503        | 503  | br0
br0.504        | 504  | br0

sudo brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.0ec608c9871f       no              em2


# Add a trunking bridge between two VMs for inter-VM traffic
sudo brctl addbr br1
sudo vconfig add br1 505
Added VLAN with VID == 505 to IF -:br1:-
sudo vconfig add br1 506
Added VLAN with VID == 506 to IF -:br1:-
sudo ip link set up dev br1
sudo ip link set up dev br1.505
sudo ip link set up dev br1.506
brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.0ec608c9871f       no              em2
br1             8000.6e095a72ee74       no              

sudo cat /proc/net/vlan/config
VLAN Dev name    | VLAN ID
Name-Type: VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD
br0.503        | 503  | br0
br0.504        | 504  | br0
br1.505        | 505  | br1
br1.506        | 506  | br1


# Add a final trunk bridge on the other physical NIC which can be an "inside" interface, the second VM can bind to:
sudo brctl addbr br2
sudo vconfig add br2 507
Added VLAN with VID == 505 to IF -:br1:-
sudo vconfig add br2 508
Added VLAN with VID == 506 to IF -:br1:-
sudo ip link set up dev br2
sudo ip link set up dev br2.507
sudo ip link set up dev br2.508
sudo brctl addif br2 em1

brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.0ec608c9871f       no              em2
br1             8000.6e095a72ee74       no              
br2             8000.425730355ccb       no              

sudo cat /proc/net/vlan/config
VLAN Dev name    | VLAN ID
Name-Type: VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD
br0.503        | 503  | br0
br0.504        | 504  | br0
br1.505        | 505  | br1
br1.506        | 506  | br1
br2.507        | 507  | br2
br2.508        | 508  | br2

This is the topology that has been created above:


Previous page: Bond Interface
Next page: ipset