Difference between revisions of "VLAN"

From ArchWiki
Jump to: navigation, search
(systemd-networkd bonded interface: default route needs a subnet, re Talk)
 
(36 intermediate revisions by 17 users not shown)
Line 1: Line 1:
{{stub}}
 
[[ru:VLAN]]
 
 
[[Category:Networking]]
 
[[Category:Networking]]
 +
[[ja:VLAN]]
 +
[[ru:VLAN]]
 +
[[zh-hans:VLAN]]
 +
{{Related articles start}}
 +
{{Related|Network Configuration}}
 +
{{Related|systemd-networkd}}
 +
{{Related|Netctl}}
 +
{{Related articles end}}
  
{{Article summary start}}
+
Virtual LANs give you the ability to sub-divide a LAN. Linux can accept '''VLAN''' tagged traffic and presents each '''VLAN ID''' as a different network interface (eg: {{ic|eth0.100}} for '''VLAN ID''' {{ic|100}})
{{Article summary text|VLAN}}
+
{{Article summary heading|Related}}
+
{{Article summary wiki|Network}}
+
{{Article summary wiki|Netcfg}}
+
{{Article summary end}}
+
  
==Introduction==
+
This article explains how to configure a VLAN using {{Pkg|iproute2}} and [[systemd-networkd]] or [[netctl]].
Virtual LANs give you the ability to sub-divide a LAN. Linux can accept VLAN tagged traffic and presents each VID as a different network interface (eg: eth0.100 for VID 100)
+
==Getting Started==
+
Previously Arch Linux used '''vconfig''' to setup VLANs. This had been superseded by the ip command. Make sure you have '''iproute2''' installed<br>
+
# pacman -Ss iproute2
+
Alternatively you can install [https://aur.archlinux.org/packages.php?ID=20495 vconfig] from [[AUR]]
+
  
==Configuring VLANs==
+
==Configuration==
===Adding a VLAN===
+
Previously Arch Linux used the {{ic|vconfig}} command to setup VLANs. This had been superseded by the {{ic|ip}} command. Make sure you have {{Pkg|iproute2}} installed.
To add a VLAN use a command with this needlessly long syntax:
+
 
ip link add link INTERFACE name INTERFACE.VID type vlan id VID
+
In the following examples, lets assume the '''interface''' is {{ic|eth0}}, the assigned '''name''' is {{ic|eth0.100}} and the '''vlan id''' is {{ic|100}}.
Example:
+
===Create the VLAN device===
  ip link add link eth0 name eth0.100 type vlan id 100
+
 
Run '''ifconfig -a''' to confirm that it has been created (Non deprected alternative is to run '''ip link''').<br>
+
Add the VLAN with the following command:
This interface behaves like a normal interface. All traffic routed to it will go through the master interface (in this example, eth0) but with a VLAN tag. Only VLAN aware devices can accept them if configured correctly else the traffic is dropped.<br>
+
 
Using a name like eth0.100 is just convention and not enforced. You can alternatively use eth0_100 or something descriptive like IPTV
+
  # ip link add link eth0 name eth0.100 type vlan id 100
===Configuring the VLAN===
+
 
To add an IPv4 address the the just created vlan link, and activate the link you can do:
+
Run {{ic|ip link}} to confirm that it has been created.  
ip addr add IP/NETMASK brd BROADCAST-ADDR dev INTERFACE.VID
+
 
ip link set dev INTERFACE.VID up
+
This interface behaves like a normal interface. All traffic routed to it will go through the master interface (in this example, {{ic|eth0}}) but with a VLAN tag. Only VLAN aware devices can accept them if configured correctly else the traffic is dropped.  
Example:
+
 
ip addr add 192.168.100.1/24 brd 192.168.100.255 dev eth0.100
+
Using a '''name''' like {{ic|eth0.100}} is just convention and not enforced; you can alternatively use {{ic|eth0_100}} or something descriptive like {{ic|IPTV}}. To see the VLAN ID on an interface, in case you used an unconventional name:
ip link set dev eth0.100 up
+
 
===De-Configuring the VLAN===
+
# ip -d link show eth0.100
 +
 
 +
The {{ic|-d}} flag shows full details on an interface:
 +
 
 +
# ip -d addr show
 +
4: eno1.100@eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
 +
    link/ether 96:4a:9c:84:36:51 brd ff:ff:ff:ff:ff:ff promiscuity 0
 +
    '''vlan protocol 802.1Q id 100 <REORDER_HDR>'''
 +
    inet6 fe80::944a:9cff:fe84:3651/64 scope link
 +
      valid_lft forever preferred_lft forever
 +
 
 +
===Add an IP===
 +
Now add an IPv4 address to the just created vlan link, and activate the link:
 +
{{bc|
 +
# ip addr add 192.168.100.1/24 brd 192.168.100.255 dev eth0.100
 +
# ip link set dev eth0.100 up
 +
}}
 +
===Turning down the device===
 
To cleanly shutdown the setting before you remove the link, you can do:
 
To cleanly shutdown the setting before you remove the link, you can do:
ip link set dev INTERFACE.VID down
+
{{bc|# ip link set dev eth0.100 down}}
Example:
+
===Removing the device===
ip link set dev eth0.100 down
+
===Removing a VLAN===
+
 
Removing a VLAN interface is significantly less convoluted
 
Removing a VLAN interface is significantly less convoluted
ip link delete INTERFACE.VID
+
{{bc|# ip link delete eth0.100}}
Example:
+
ip link delete eth0.100
+
  
===UDEV considerations===
+
=== Starting at boot ===
An annoyance is that '''udev''' may try to rename virtual devices as they are added, thus ignoring the INTERFACE.VID configured for them either via iproute2 or via a netcfg profile<br>
+
For instance, if the following commands are issued:
+
ip link add link eth0 name eth0.100 type vlan id 100
+
ip link show
+
This would generate the following output:
+
  
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN  
+
==== systemd-networkd single interface ====
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
+
 
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
+
Use the following configuration files:
    link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff
+
 
3: rename1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state DOWN  
+
{{hc|/etc/systemd/network/''eno1''.network|<nowiki>
 +
[Match]
 +
Name=eno1
 +
 
 +
[Network]
 +
DHCP=ipv4
 +
VLAN=eno1.100
 +
VLAN=eno1.200
 +
</nowiki>}}
 +
 
 +
{{hc|/etc/systemd/network/''eno1.100''.netdev|<nowiki>
 +
[NetDev]
 +
Name=eno1.100
 +
Kind=vlan
 +
 
 +
[VLAN]
 +
Id=100
 +
</nowiki>}}
 +
 
 +
{{hc|/etc/systemd/network/''eno1.200''.netdev|<nowiki>
 +
[NetDev]
 +
Name=eno1.200
 +
Kind=vlan
 +
 
 +
[VLAN]
 +
Id=200
 +
</nowiki>}}
 +
 
 +
You'll have to have associated .network files for each .netdev to handle addressing and routing.
 +
 
 +
Then [[enable]] {{ic|systemd-networkd.service}}. See [[systemd-networkd]] for details.
 +
 
 +
==== systemd-networkd bonded interface ====
 +
 
 +
Similar to above, you're just going to stack more of the concepts in place. You'll want to ensure that you've got a bond set up in your switch and also make sure its a trunk with tagged vlans corresponding to what you create below. First we'll create the bond device:
 +
 
 +
{{hc|/etc/systemd/network/''bond0''.netdev|<nowiki>
 +
[NetDev]
 +
Name=bond0
 +
Kind=bond
 +
 
 +
[Bond]
 +
Mode=802.3ad
 +
LACPTransmitRate=fast
 +
</nowiki>}}
 +
 
 +
Now create a .network directive that references the vlans and interface carriers. In this case we'll use the convention for a dual port fiber module:
 +
 
 +
{{hc|/etc/systemd/network/''bond0''.network|<nowiki>
 +
[Match]
 +
Name=bond0
 +
 
 +
[Network]
 +
VLAN=vlan10
 +
VLAN=vlan20
 +
VLAN=vlan30
 +
BindCarrier=enp3s0f0 enp3s0f1
 +
</nowiki>}}
 +
 
 +
We're using the vlan<number> naming convention here, you can use something else but realize that this is a named reference so you'll have to have a corresponding set of files with the same name.
 +
 
 +
We'll now set up the physical network interfaces:
 +
 
 +
{{hc|/etc/systemd/network/''enp3s0f0''.network|<nowiki>
 +
[Match]
 +
Name=enp3s0f0
 +
 
 +
[Network]
 +
Bond=bond0
 +
</nowiki>}}
 +
 
 +
{{hc|/etc/systemd/network/''enp3s0f1''.network|<nowiki>
 +
[Match]
 +
Name=enp3s0f1
 +
 
 +
[Network]
 +
Bond=bond0
 +
</nowiki>}}
 +
 
 +
At this time you could reboot, and likely should, because the bonded interface is created at boot time. Restarting systemd-networkd will consume changes from these files typically, but device creation seems to occur at startup.
 +
 
 +
We will now set up the VLANs. You should be aware that having multiple VLANs can result in a situation where your machine has multiple default routes, so you'll need to specify a Destination directive in the network directives to ensure that only one VLAN is being used for a default route. In this case we'll use the VLAN with an ID of 10 as our default route.
 +
 
 +
{{hc|/etc/systemd/network/''vlan10''.netdev|<nowiki>
 +
[NetDev]
 +
Name=vlan10
 +
Kind=vlan
 +
 
 +
[VLAN]
 +
Id=10
 +
</nowiki>}}
 +
 
 +
Now create the associated network directive to set an address:
 +
 
 +
{{hc|/etc/systemd/network/''vlan10''.network|<nowiki>
 +
[Match]
 +
Name=vlan10
 +
 
 +
[Network]
 +
VLAN=vlan10
 +
 
 +
[Address]
 +
Address=10.10.10.2/24
 +
 
 +
[Route]
 +
Destination=0.0.0.0/0
 +
Gateway=10.10.10.1
 +
</nowiki>}}
 +
 
 +
We'll create a similar pair of files for the VLAN with an ID of 20:
 +
 
 +
{{hc|/etc/systemd/network/''vlan20''.netdev|<nowiki>
 +
[NetDev]
 +
Name=vlan20
 +
Kind=vlan
 +
 
 +
[VLAN]
 +
Id=20
 +
</nowiki>}}
 +
 
 +
 
 +
{{hc|/etc/systemd/network/''vlan20''.network|<nowiki>
 +
[Match]
 +
Name=vlan20
 +
 
 +
[Network]
 +
VLAN=vlan20
 +
 
 +
[Address]
 +
Address=10.10.20.2/24
 +
 
 +
[Route]
 +
Destination=10.10.20.0/24
 +
Gateway=10.10.20.1
 +
</nowiki>}}
 +
 
 +
And again for the VLAN with an ID of 30:
 +
 
 +
{{hc|/etc/systemd/network/''vlan30''.netdev|<nowiki>
 +
[NetDev]
 +
Name=vlan30
 +
Kind=vlan
 +
 
 +
[VLAN]
 +
Id=30
 +
</nowiki>}}
 +
 
 +
{{hc|/etc/systemd/network/''vlan30''.network|<nowiki>
 +
[Match]
 +
Name=vlan30
 +
 
 +
[Network]
 +
VLAN=vlan30
 +
 
 +
[Address]
 +
Address=10.10.30.2/24
 +
 
 +
[Route]
 +
Destination=10.10.30.0/24
 +
Gateway=10.10.30.1
 +
</nowiki>}}
 +
 
 +
Note that the Destination on vlan10 is set to 0.0.0.0/0, which will match all outbound, becoming the default route.
 +
 
 +
==== netctl ====
 +
 
 +
You can use [[netctl]] for this purpose, see the self-explanatory example profiles in {{ic|/etc/netctl/examples/vlan-{dhcp,static} }}.
 +
 
 +
==Troubleshooting==
 +
===udev renames the virtual devices===
 +
An annoyance is that [[udev]] may try to rename virtual devices as they are added, thus ignoring the '''name''' configured for them (in this case {{ic|eth0.100}}).
 +
 
 +
For instance, if the following commands are issued:
 +
{{bc|
 +
# ip link add link eth0 name eth0.100 type vlan id 100
 +
# ip link show
 +
}}
 +
This could generate the following output:
 +
{{bc|<nowiki>
 +
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN  
 +
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
 +
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
 +
    link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff
 +
3: rename1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state DOWN  
 
     link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff
 
     link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff
 +
</nowiki>}}
 +
'''udev''' has ignored the configured virtual interface name {{ic|eth0.100}} and autonamed it '''rename1'''.
  
'''udev''' has ignored the configured virtual interface name of INTERFACE.VID and autonamed it '''rename1'''. Hmmph!
+
The solution is to edit {{ic|/etc/udev/rules.d/network_persistent.rules}} and append '''DRIVERS=="?*"''' to the end of the physical interface's configuration line.
  
The solution is to edit /etc/udev/rules.d/network_persistent.rules and append '''DRIVERS=="?*"''' to the end of the physical interface's configuration line. <br>
 
 
For example, for the interface '''aa:bb:cc:dd:ee:ff''' (eth0):  
 
For example, for the interface '''aa:bb:cc:dd:ee:ff''' (eth0):  
SUBSYSTEM=="net", ATTR{address}=="aa:bb:cc:dd:ee:ff", NAME="eth0", DRIVERS=="?*"
+
{{hc|/etc/udev/rules.d/network_persistent.rules|<nowiki>
 +
SUBSYSTEM=="net", ATTR{address}=="aa:bb:cc:dd:ee:ff", NAME="eth0", DRIVERS=="?*"
 +
</nowiki>}}
  
 
A reboot should mean that VLANs configure correctly with the names assigned to them.
 
A reboot should mean that VLANs configure correctly with the names assigned to them.
 
==VLANs at boot==
 
You can use netcfg profile and put POST_UP, PRE_DOWN command to do above action.
 
(Similar thing as done here: [https://bbs.archlinux.org/viewtopic.php?pid=1036395#p1036395])
 
I did it for my eht0, that have is both multi-home (DHCP to the modem, and local subnet 192.168.12.0), and VLAN 112 as well.
 
Here is an extract of a sample /etc/rc.d/my-network file:
 
CONNECTION='ethernet'
 
DESCRIPTION='modem cable connection'
 
INTERFACE='eth0'
 
IP='dhcp'
 
POST_UP='ip addr add 192.168.12.1/24 brd 192.168.12.255 dev eth0; ip link add link eth0 name eth0.112 type vlan id 112; ip addr add 192.168.112.1/24 brd 192.168.112.255 dev eth0.112; ip link set dev eth0.112 up'
 
PRE_DOWN='ip link set dev eth0.112 down; ip link delete eth0.112; ip addr del 192.168.12.1/24 dev eth0'
 
 
Question: Any \ like syntax available at eol to have POST_UP split on multi-line ?<br>
 
Seems it should be possible to put such control directly for netcfg into /etc/rc.conf (instead of inside the POST_UP in the netcfg profile file).
 
Extra info on how to do that still missing ... (not clear)<br>
 
possible issue is to get error in one of commands put inside POST_UP/PRE_DOWN.
 
This can prevent to manual stop/start control of the network link
 
===Manual start/stop===
 
To control by hand the link after boot using the netcfg profile you put in place, you can try following commands:
 
/etc/rc.d/net-profiles restart
 
/etc/rc.d/net-profiles stop
 
/etc/rc.d/net-profiles start
 

Latest revision as of 01:16, 20 February 2017

Virtual LANs give you the ability to sub-divide a LAN. Linux can accept VLAN tagged traffic and presents each VLAN ID as a different network interface (eg: eth0.100 for VLAN ID 100)

This article explains how to configure a VLAN using iproute2 and systemd-networkd or netctl.

Configuration

Previously Arch Linux used the vconfig command to setup VLANs. This had been superseded by the ip command. Make sure you have iproute2 installed.

In the following examples, lets assume the interface is eth0, the assigned name is eth0.100 and the vlan id is 100.

Create the VLAN device

Add the VLAN with the following command:

# ip link add link eth0 name eth0.100 type vlan id 100

Run ip link to confirm that it has been created.

This interface behaves like a normal interface. All traffic routed to it will go through the master interface (in this example, eth0) but with a VLAN tag. Only VLAN aware devices can accept them if configured correctly else the traffic is dropped.

Using a name like eth0.100 is just convention and not enforced; you can alternatively use eth0_100 or something descriptive like IPTV. To see the VLAN ID on an interface, in case you used an unconventional name:

# ip -d link show eth0.100

The -d flag shows full details on an interface:

# ip -d addr show
4: eno1.100@eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
   link/ether 96:4a:9c:84:36:51 brd ff:ff:ff:ff:ff:ff promiscuity 0 
   vlan protocol 802.1Q id 100 <REORDER_HDR> 
   inet6 fe80::944a:9cff:fe84:3651/64 scope link 
      valid_lft forever preferred_lft forever

Add an IP

Now add an IPv4 address to the just created vlan link, and activate the link:

# ip addr add 192.168.100.1/24 brd 192.168.100.255 dev eth0.100
# ip link set dev eth0.100 up

Turning down the device

To cleanly shutdown the setting before you remove the link, you can do:

# ip link set dev eth0.100 down

Removing the device

Removing a VLAN interface is significantly less convoluted

# ip link delete eth0.100

Starting at boot

systemd-networkd single interface

Use the following configuration files:

/etc/systemd/network/eno1.network
[Match]
Name=eno1

[Network]
DHCP=ipv4
VLAN=eno1.100
VLAN=eno1.200
/etc/systemd/network/eno1.100.netdev
[NetDev]
Name=eno1.100
Kind=vlan

[VLAN]
Id=100
/etc/systemd/network/eno1.200.netdev
[NetDev]
Name=eno1.200
Kind=vlan

[VLAN]
Id=200

You'll have to have associated .network files for each .netdev to handle addressing and routing.

Then enable systemd-networkd.service. See systemd-networkd for details.

systemd-networkd bonded interface

Similar to above, you're just going to stack more of the concepts in place. You'll want to ensure that you've got a bond set up in your switch and also make sure its a trunk with tagged vlans corresponding to what you create below. First we'll create the bond device:

/etc/systemd/network/bond0.netdev
[NetDev]
Name=bond0
Kind=bond

[Bond]
Mode=802.3ad
LACPTransmitRate=fast

Now create a .network directive that references the vlans and interface carriers. In this case we'll use the convention for a dual port fiber module:

/etc/systemd/network/bond0.network
[Match]
Name=bond0

[Network]
VLAN=vlan10
VLAN=vlan20
VLAN=vlan30
BindCarrier=enp3s0f0 enp3s0f1

We're using the vlan<number> naming convention here, you can use something else but realize that this is a named reference so you'll have to have a corresponding set of files with the same name.

We'll now set up the physical network interfaces:

/etc/systemd/network/enp3s0f0.network
[Match]
Name=enp3s0f0

[Network]
Bond=bond0
/etc/systemd/network/enp3s0f1.network
[Match]
Name=enp3s0f1

[Network]
Bond=bond0

At this time you could reboot, and likely should, because the bonded interface is created at boot time. Restarting systemd-networkd will consume changes from these files typically, but device creation seems to occur at startup.

We will now set up the VLANs. You should be aware that having multiple VLANs can result in a situation where your machine has multiple default routes, so you'll need to specify a Destination directive in the network directives to ensure that only one VLAN is being used for a default route. In this case we'll use the VLAN with an ID of 10 as our default route.

/etc/systemd/network/vlan10.netdev
[NetDev]
Name=vlan10
Kind=vlan

[VLAN]
Id=10

Now create the associated network directive to set an address:

/etc/systemd/network/vlan10.network
[Match]
Name=vlan10

[Network]
VLAN=vlan10

[Address]
Address=10.10.10.2/24

[Route]
Destination=0.0.0.0/0
Gateway=10.10.10.1

We'll create a similar pair of files for the VLAN with an ID of 20:

/etc/systemd/network/vlan20.netdev
[NetDev]
Name=vlan20
Kind=vlan

[VLAN]
Id=20


/etc/systemd/network/vlan20.network
[Match]
Name=vlan20

[Network]
VLAN=vlan20

[Address]
Address=10.10.20.2/24

[Route]
Destination=10.10.20.0/24
Gateway=10.10.20.1

And again for the VLAN with an ID of 30:

/etc/systemd/network/vlan30.netdev
[NetDev]
Name=vlan30
Kind=vlan

[VLAN]
Id=30
/etc/systemd/network/vlan30.network
[Match]
Name=vlan30

[Network]
VLAN=vlan30

[Address]
Address=10.10.30.2/24

[Route]
Destination=10.10.30.0/24
Gateway=10.10.30.1

Note that the Destination on vlan10 is set to 0.0.0.0/0, which will match all outbound, becoming the default route.

netctl

You can use netctl for this purpose, see the self-explanatory example profiles in /etc/netctl/examples/vlan-{dhcp,static} .

Troubleshooting

udev renames the virtual devices

An annoyance is that udev may try to rename virtual devices as they are added, thus ignoring the name configured for them (in this case eth0.100).

For instance, if the following commands are issued:

# ip link add link eth0 name eth0.100 type vlan id 100
# ip link show 

This could generate the following output:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff
3: rename1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state DOWN 
    link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff

udev has ignored the configured virtual interface name eth0.100 and autonamed it rename1.

The solution is to edit /etc/udev/rules.d/network_persistent.rules and append DRIVERS=="?*" to the end of the physical interface's configuration line.

For example, for the interface aa:bb:cc:dd:ee:ff (eth0):

/etc/udev/rules.d/network_persistent.rules
SUBSYSTEM=="net", ATTR{address}=="aa:bb:cc:dd:ee:ff", NAME="eth0", DRIVERS=="?*"

A reboot should mean that VLANs configure correctly with the names assigned to them.