VLANs and Trunking

Why VLANs exist

A VLAN is a broadcast domain defined in switch software instead of by cabling. One physical switch can carry many logically separate networks, and hosts in different VLANs cannot reach each other without a router.

The usual pairing is one VLAN to one IP subnet. Two subnets in one VLAN works but means both share broadcast traffic, and one subnet split across VLANs needs bridging to function at all.

The 802.1Q tag

The tag is inserted into the Ethernet header after the source MAC, adding 4 bytes and raising the maximum frame from 1518 to 1522.

+---------+---------+---------------------------+-----------+---------+
| Dst MAC | Src MAC |       802.1Q tag          | EtherType | Payload |
|    6    |    6    |         4 bytes           |     2     |         |
+---------+---------+---------------------------+-----------+---------+
                     |
     +---------------+-----------------------------------+
     | TPID 0x8100 (16) | PCP (3) | DEI (1) | VID (12)   |
     +--------------------------------------------------+

QinQ (802.1ad) stacks two tags, an outer service tag and an inner customer tag, which carriers use to tunnel a customer's whole VLAN space.

Access ports, trunk ports, and the native VLAN

The native VLAN on a trunk is the one sent untagged, so it interoperates with devices that do not understand tags. Two rules:

- The native VLAN must match on both ends of the trunk, or traffic silently crosses into the wrong VLAN. - A mismatched or unused native VLAN enables VLAN hopping by double tagging, where an attacker sends a frame with two tags and the switch strips only the outer one. Mitigate by setting the native VLAN to an unused ID and pruning every VLAN you do not need from the trunk.

Voice VLANs are the common exception: an IP phone gets a tagged voice VLAN while the PC daisy-chained behind it stays on the untagged data VLAN.

Inter-VLAN routing

VLANs isolate at layer 2, so something at layer 3 has to join them.

Cisco style, router on a stick

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

Each VLAN's gateway is the SVI or subinterface address, and hosts in that VLAN point their default route at it.

VLANs on Linux

# tagged subinterface on a trunk NIC
ip link add link eth0 name eth0.10 type vlan id 10
ip addr add 192.168.10.5/24 dev eth0.10
ip link set eth0.10 up
ip -d link show eth0.10            # confirm the vlan id and protocol
ip link del eth0.10

# 802.1ad QinQ stack
ip link add link eth0 name eth0.100 type vlan proto 802.1ad id 100
ip link add link eth0.100 name eth0.100.10 type vlan id 10

# VLAN-aware bridge, the container and VM pattern
ip link add br0 type bridge vlan_filtering 1
ip link set eth0 master br0
bridge vlan add dev eth0 vid 10-20 tagged
bridge vlan add dev veth1 vid 10 pvid untagged
bridge vlan show

pvid untagged makes a bridge port behave as an access port for that VLAN. Without vlan_filtering 1 a Linux bridge passes tags through blindly and enforces nothing.

Verifying and troubleshooting

cat /proc/net/vlan/config
ip -d link show type vlan
tcpdump -i eth0 -e -nn vlan          # -e prints the L2 header and tag
tcpdump -i eth0 -e -nn vlan 10
ethtool -k eth0 | grep -i vlan       # offload can hide tags from tcpdump