HowTo: Configure Linux Virtual Local Area Network (VLAN)

by on June 6, 2006 · 52 comments· LAST UPDATED February 28, 2014

in , ,

VLAN is an acronym for Virtual Local Area Network. Several VLANs can co-exist on a single physical switch, which are configured via Linux software and not through hardware interface (you still need to configure actual hardware switch too).

Hubs or switch connects all nodes in a LAN and node can communicate without a router. For example, all nodes in LAN A can communicate with each other without the need for a router. If a node from LAN A wants to communicate with LAN B node, you need to use a router. Therefore, each LAN (A, B, C and so on) are separated using a router.

VLAN as a name suggest combine multiple LANs at once. But, what are the advantages of VLAN?

  • Performance.
  • Ease of management.
  • Security.
  • Trunks.
  • VLANs give you the ability to sub-divide a LAN for security purpose.
  • You don't have to configure any hardware device, when physically moving server computer to another location and more.

Fundamental discussion about VLAN or switches is beyond the scope of this blog post. I suggest the following textbooks:

A note about your LAN hardware

  1. To be able to use VLANs you will need a switch that support the IEEE 802.1q standard on an Ethernet network.
  2. You will also need a NIC (Network Interface Card) that works with Linux and support 802.1q standard .

Linux VLAN configuration issues

I am lucky enough to get a couple of hints from our internal wiki:

  • Not all network drivers support VLAN. You may need to patch your driver.
  • MTU may be another problem. VLAN works by tagging each frame i.e. an Ethernet header extension that enlarges the header from 14 to 18 bytes. The VLAN tag contains the VLAN ID and priority.
  • Do not use VLAN ID 1 as it may be used for admin purpose.

Enough talk, let's get to the Linux VLAN configurations.

Setting up 802.1q VLAN tagging by loading 8021q Linux kernel driver

First, make sure that the Linux kernel driver (module) called 8021q is loaded:
# lsmod | grep 8021q
If the module is not loaded, load it with the following modprobe command:
# modprobe 8021q

Method #1: CentOS/RHLE/Fedora Linux VLAN HowTo

I am using RHEL/CentOS Linux with VLAN ID # 5. So I need to copy file /etc/sysconfig/network-scripts/ifcfg-eth0 to /etc/sysconfig/network-scripts/ifcfg-eth0.5
# cp /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0.5
Now, I've one network card (eth0) and it needs to tagged network traffic for VLAN ID 5.

  • eth0 - Your regular network interface
  • eth0.5 - Your virtual interface that use untagged frames

Do not modify /etc/sysconfig/network-scripts/ifcfg-eth0 file. Now open file /etc/sysconfig/network-scripts/ifcfg-eth0.5 using a text editor such as vi, type:
# vi /etc/sysconfig/network-scripts/ifcfg-eth0.5
Find DEVICE=eth0 line and replace with:
DEVICE=eth0.5
Also, append the following line:
VLAN=yes
Make sure you assign correct IP address using DHCP or static IP. Remove gateway entry from all other network config files. Only add gateway to /etc/sysconfig/network file. This whole configuration may sound complicated. So I am including sample configurations files for you:

/etc/sysconfig/network-scripts/ifcfg-eth0.5 file

# VLAN configuration for my eth0  with ID - 5 #
DEVICE=eth0.5
BOOTPROTO=none
ONBOOT=yes
IPADDR=192.168.1.5
NETMASK=255.255.255.0
USERCTL=no
NETWORK=192.168.1.0
VLAN=yes
 

/etc/sysconfig/network-scripts/ifcfg-eth0 file

# Actual configuration for my eth0 physical interface ##
DEVICE=eth0
TYPE=Ethernet
BOOTPROTO=none
ONBOOT=yes
 

Finally, restart networking service on a CentOS/RHEL/Fedora Linux, type:
# /etc/init.d/network restart
OR
# service network restart

NOTE: If you need a second VLAN i.e. you need to configure for VLAN ID 2 then copy the /etc/sysconfig/network-scripts/ifcfg-eth0 to /etc/sysconfig/network-scripts/ifcfg-eth0.2 and do the above procedure again.

Method #2: Using the vconfig command

Above method is perfect and works with a Red hat Enterprise Linux / CentOS / Fedora Linux without any problem. However, you will notice that there is a command called vconfig. The vconfig program allows you to create and remove vlan-devices on a vlan enabled kernel. Vlan-devices are virtual Ethernet devices which represents the virtual lans on the physical lan. This is yet another method of configuring VLAN. To add VLAN ID 5 with following command for eth0 interface:
# vconfig add eth0 5
The vconfig add command creates a vlan-device on eth0 which result into eth0.5 interface. You can use normal ifconfig command to see device information:
# ifconfig eth0.5
Use ifconfig command to assign IP address to vlan interfere:
# ifconfig eth0.5 192.168.1.100 netmask 255.255.255.0 broadcast 192.168.1.255 up
To get detailed information about VLAN interface, type:
# cat /proc/net/vlan/eth0.5
If you wish to delete VLAN interface use delete command as follows:
# ifconfig eth0.5 down
# vconfig rem eth0.5

See vconfig(8) Linux man page for more information on syntax and examples.

Method #3: Create the VLAN device using the ip command

Use the ip command as follows for the interface eth0, and the vlan id is 5:
# ip link add link eth0 name eth0.5 type vlan id 5
# ip link
# ip -d link show eth0.5

You need to activate and add an IP address to vlan link, type:
# ip addr add 192.168.1.200/24 brd 192.168.1.255 dev eth0.5
# ip link set dev eth0.5 up

All traffic will go through the eth0 interface bith with a BLAN tag 5. Only VLAN aware devices can accept the traffic, otherwise the traffic is dropped.

How can I remove VLAN ID 5?

Type the following commands
# ip link set dev eth0.5 down
# ip link delete eth0.5

How do I make above VLAN configuration permanent on a Debian or Ubuntu based system?

Edit the /etc/network/interfaces file, enter:
$ sudo vi /etc/network/interfaces
Update configuration as follows:

## vlan for eth0 with ID - 5 on a Debian/Ubuntu Linux##
auto eth0.5
iface eth0.5 inet static
    address 192.168.1.200
    netmask 255.255.255.0
    vlan-raw-device eth0
 

Save and close the file.

See also

# Additional correction by John T and others; Editing by VG - log #

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 52 comments… read them below or add one }

1 Ted June 7, 2006 at 8:02 pm

A VLAN is a logical grouping of two or more servers which are not necessarily on the same physical network segment but which share the same IP network subnet. The advantage to passing traffic across a VLAN versus a LAN is that information on one VLAN can only be seen on that VLAN, and not by every server on the entire LAN. This is especially beneficial when you have many different nodes on a network sharing information with each other.

Most web server hosting companies deploys some sort of VLAN to protect customers.

Reply

2 Edgar Ramirez September 9, 2011 at 5:31 pm

Do you know if i can create vlans over vlans. Let me explain myself:

I have a vmware linux virtual machine with 2 “virtual physical ” interfaces (eth0 and eth1) virtual eth0 is bridged to the laptop eth0 physical interface and virtual eth1 is bridged to a eth0.172 virtual interface in the vlan 172. All these connected to the switch port … untagged for VLAN 1 and tagged for VLAN 172. I need to create a VLAN 1010 over the virtual eth1 inside the virtual machine to communicate to the vlan 1010 in the switch.

Can that be possible?

Reply

3 anoop June 27, 2006 at 6:25 pm

plese send me how to configure vlan in linux

Reply

4 nixCraft June 28, 2006 at 12:02 am

@anoop
err .. sorry i just forgot to add Instructions as I am busy on some other work.. I will add them possibly by tomorrow

Reply

5 Bill August 14, 2006 at 2:41 am

A VLAN is a “Virtual Local Area Network” and is present in L2 (Level 2) of the protocal stack. The above postings may be misleading in that the word “server” is used rather than “host”.

A host may be a server, workstation or other device which conforms to 802.1q specification. Therefore, it is possible (with certain limitations) to attach a laptop to a VLAN seen by a server.

802.1q provides for an additional 4-bytes of information added to the L2 frame, 12 bits of which indicate the VLAN is. Thus one may have 4K VLANs.

When you want to configure a VLAN in Linux, assuming your kernel supports it (2.6+ do) you need to make sure 802.1q support is available. This is most easily done with modprobe. So the command:

/sbin/modprobe 8021q

should do the trick.

Then, for any given NIC interface you only have to do the following:

/sbin/vconfig add eth
/sbin/ifconfig eth. 192.168.0.x netmask 255.255.255.0

Of course I just picked some arbitrary class C address, you would have to use what is appropriate for you.

You may need then to add to the routing table (not knowing what Linux you are running) something like:

/sbin/route add -net 192.168.0.0 netmask 255.255.255.0 eth.

ALL THE ABOVE MUST BE AS ROOT.

Reply

6 Samarendra Saha September 13, 2006 at 12:16 pm

How can config IP addressing in Suse linux? Please send me the path to adding the IP address and make a work group.

Reply

7 viswanathsingh September 13, 2006 at 1:17 pm

could you pleasesend me the instructions for setting up the VLAN

Reply

8 nixCraft September 13, 2006 at 7:05 pm

viswanathsingh,

Instructions/commands are mentioned above. Please read the vconfig and VLAN config section.

Reply

9 nixCraft September 13, 2006 at 7:07 pm

Samarendra,

Run yast or yast2 command to change network configuration under Suse Linux.

yast
OR
yast2

Reply

10 viswanath September 14, 2006 at 3:54 pm

Any one is having idea how to test VTUN

Reply

11 viswanath September 14, 2006 at 3:55 pm

how to test VLAN (i want to know basic scenario)

Reply

12 Luigi January 31, 2007 at 8:58 am

Hi, I’ve configure a repotec switch with vlans 802.1q and my pc with Ubuntu(my router) to use vlan tagged protocol.
It works fine for Internet navigation, but I can’t access to web pages on my Ubuntu server.

I’ve look in some forums and in google but I haven’t found nothing.

Somebody can help me?

Thanks

Reply

13 sai kris June 3, 2007 at 5:07 pm

how to add loopback adapter in rhel 4.0

Reply

14 Eric Arnaud July 3, 2007 at 3:24 am

Here is my problem.

Office 1 has 3 networks (VLAN port-based)
Office 2 is 500′ away with a switch in the middle and only one cat5 cable

I’m trying to find a way to convert port-based vlan to TAG (IEEE 802.1Q or similar )

Ex: On a x86 with linux or wrt54g

Port1 = Lan #1 => Tag #1 on port4
Port2 = Lan #2 => Tag #1 on port4
Port3 = Lan #3 => Tag #1 on port4

port4 got to the other wrt54g on port4

on the other device

port4 (tag #1) => Port1
port4 (tag #2) => Port2
port4 (tag #3) => Port3

So basicly is how to tag a incomming packet on port x and untag once on the other side.
The routing part is almost simple.

Eric

Reply

15 George July 26, 2007 at 7:20 pm

I was looking for a site to explain this in plain english and i found it! thank god! :)

a few questions:
1st, how can i configure the system so everything takes a dhcp address once the system initializes? Should i configure a dhcp server so that when a computer starts it will send a DHCP request? How can i setup a dhcp server to give different ip address ranges to different VLANS? If i am trying to access a resource from within a vlan, will i need a dns server internally to translate the domain name (if used) to the different ip addresses a device will have?

thanks!

Reply

16 Vivek October 13, 2007 at 12:53 pm

Sir,
I have followed the steps mentioned in “How to configure VLAN in LINUX”. I am using fedora 7.
although I am able to configure VLAN but I am not able to ping it to my client computer and vice versa.
If I don’t configure vlan then everything works fine on this interface i.e. eth1.
Kindly provide me with some solution.

Reply

17 fsmendoza November 29, 2007 at 3:47 pm

Hi everyone,

is it possible to do “one dhcp server using multiple vlan’s”? does anyone successfully do this? Please let us know howto.

Thank you.

Reply

18 csmith January 11, 2008 at 11:21 pm

“one dhcp server using multiple vlan’s”
I’d presume you change /etc/sysconfig/dhcpd file
specify which virtual adaptors you want the dhcpd service to runon “eth0 eth1 eth1.10″ would be ethernet if 0, 1, and vlan 10 on eth1. Thats where I’d start. Though you may have a lot of….er..fun if you dont have an injection of which vlan is making the request they’ll all get the same pool. (option 82 enabled devices)

Reply

19 Gagan February 28, 2008 at 2:36 pm

Hi,

is there any way to find out that whether systems are connected under physical or virtual LAN’s?

please tell me know …

Reply

20 Bincy March 19, 2008 at 8:35 am

I have configured valn in two linux machines with vlan id 4. Ping is working between the virtual interfaces but the ping packets have no tag attached.

I anyone have some idea please share..

Thanks

Reply

21 ubaid June 11, 2008 at 8:22 pm

i have xp in my system but i wanna install ubundu Linux on it by virtual machine but it running till when it display one error after that it need additional virtual machine it cant be go ahead give me salvations how it ll be install on xp plz

Reply

22 after reading,there are some question June 20, 2008 at 9:46 pm

Ye,after reading this topic,I learn a lot.So first,say thanks everyone.
Back to this topic,I have a question.
At say of topic owner,”an Ethernet header extension that enlarges the header from 14 to 18 bytes”,what means? I capture a frame. A Ethernet header contains destination,source,type fields.(I use adsl).And en-largeing above means add a field at Ethernet header,or add one in other place?
My Goal is building a experiment environment for network communication. It will be a complex one.It contains hundreds nodes with multiple topology structures.
Could someone give me a hand?And is vlan OK for it?If not,which can?

Reply

23 shirish July 17, 2008 at 9:30 am

very Helpful

Reply

24 D September 26, 2008 at 5:49 pm

It worked

Reply

25 siva November 14, 2008 at 8:33 am

Hey folks,

I have a couple of questions:

1.If i want to copy a file from my windows desktop to my linux (RHEL 4.0) virtual machine, how should i do it?

2.How can i assign ip address to my virtual machine?

Thanks
NSiva

Reply

26 dekkard December 25, 2008 at 6:04 am

very nice! 2 minutes & vlans are set
thanx

Reply

27 sathishenet February 10, 2009 at 6:49 am

Hi All,

Very very basic question, for configuring VLAN in Linux is that necessary to have a manageable switches ??

Thanks,
Sathish

Reply

28 Manisha April 20, 2009 at 12:20 pm

Can you give me the whole codes for virtual lan. and there should be browser and it should allow us to access a file from another ip address and it should allow copy, paste, save, open commands in that programm for that access file.

Reply

29 Shlomi May 25, 2009 at 12:31 pm

The line “DEVICE=ifcfg-eth0.5″, should be written as “DEVICE=eth0.5″ !!!

Reply

30 Arun Menon November 26, 2009 at 10:48 am

hey folks
how can i configure the vlan priority bits on the ethernet header…it wud be of gr8 help if ne1 could provide som inputs on this

regards
Arun

Reply

31 Venkat January 17, 2010 at 2:44 am

In the above test I have seen the statement like “Remove gateway entry from all other network config files.” How can I find the places where the gateway is configured on the system ?

Please let me know how can I test my vlan config using one single Linux PC ?

Reply

32 sayantan February 7, 2010 at 8:18 am

is it virtual ip?can it be used with RAC?

Reply

33 hafeez March 18, 2010 at 7:29 am

A working configuration example from hafeezisbad@gmail.com

Server ip : 172.27.0.10
Swtich ip / gateway ip of server : 172.27.0.100
Option domain –name servers : 172.27.0.6

Please note default vlan 172.27.0.x in this case

Switch and server need to be in default lan for communication / or else we need to trunk in case other vlan connected , we need to configure vconfig on server to communicate

For biggner I would recommend to go for the default vlan connectivity

Example :

ddns-update-style interim;
ignore client-updates;
default-lease-time 43200;
max-lease-time 43200;
authoritative;
#-----subnet mask-- broadcast-- gateway-#
option subnet-mask 255.255.255.0;
#option broadcast-address 192.168.1.1;
option routers 172.27.0.100;
option domain-name-servers 172.27.0.6;
# ----------- Server Scope and vlan1 with switches and server--------------#
subnet 172.27.0.0 netmask 255.255.255.0 {
#range 172.27.0.0 172.27.0.50;
option routers 172.27.0.1;
#option subnet-mask 255.255.255.0;
option broadcast-address 172.27.0.255;
#option domain-name-servers 172.27.0.5;
}
# ----------- clients1 Scope-vlan2-------------#
subnet 172.27.1.0 netmask 255.255.255.0 {
range 172.27.1.3 172.27.1.200;
option routers 172.27.1.1;
option subnet-mask 255.255.255.0;
option broadcast-address 172.27.1.255;
#option domain-name-servers 192.168.1.1 #
}
Save the file
Chkconfig –list dhcpd on

{ For enabling the service on all run levels }
Service dhcpd start
In case , dhcp server faild to start , check with log messages

/var/log/messages

Check for the ip helper address in layer 3 swtich , which act as dhcp-relay
Which has to be configured as 172.27.0.10

Troubleshooting Dhcp server start up error :

1) Run the Dhcp service in debug mode
2) Check the ip configuration
3) Check for syntax errors in dhcpd.conf file
4) Check for the right location of the dhcpd file
5) Ping test between the switch and server
6) Possible conflict of other dhcp server may be the issue

dhcpd in the foreground in debug mode with /usr/sbin/dhcpd -d –f

Hopefully, a DHCP server like the one we’ll be configuring will respond. Running tcpdump shows a dhcp request looks like:
17:26:02.003956 00:00:00:00:00:00 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0×0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request, length 300
You should notice DHCP running in the process (ps) list. Any problems, check syslog

Congratulations you have finally configured In easy steps

Reply

34 kashyap April 6, 2010 at 7:14 am

Hi,
I have just installed rh5 in a Xen server. I have attached a vlan to the virtual rh5 server.
The problem is I am unable to view any interface. I see only loop back device.
I have even tried modprobe 8021q but still no success.
I am using 2.6.18-92.el5xen kernal.
Any help would be great

Reply

35 Redman April 21, 2010 at 9:49 am

hi all

we are on a VLAN Network my issue is on the dhcpd.conf side coz wana configure My opensuse 11 box to serve ip’s (DHCP Server) on diffrent VLAN , Wana Replace our Windows DHCP Server for some Technical Reasons , my susebux has only one phsysical Network interface , is this possible to serve all VLAN? iphelper is already confgured on our L3 Switches , actually OUr Windows DHCP Server is already runnning and serving this vlans , but i just wana replace it with linux

is this a dhcpd issue to vconfig?

heres is our VLAN Scheme

Dept.1

VLAN # xx
Range : 192.168.24.xxx-xxx

Dept.2
VLAN # xx
Range : 192.168.24.xxx – xxx

Dept.3
VLAN # xx
Range : 192.168.24.xxx-xxx

Dept.4
VLAN #xx
Range : 192.168.24.xxx-xxx

Dept. 5
VLAN # xx
Range 192.168.20.xxx.xxx

Reply

36 Bo Svensson May 8, 2010 at 11:37 am

Hi all!
I want to set up a functionality rich, cost efficient, energy efficient, network like this:
– A Linux box (e.g. based on a Mini-ITX with one NIC),
connected to a managed switch (with VLAN support, like DES-3010GA).
The link between Linux box and switch will be only tagged (all VLAN:s).
On the switch I want untagged VLAN:s, like “internet”, “DMZ” and “LAN”.

My question: Can the Linux box be both VLAN manager and router (replace
a Level 3 switch) and firewall or do I need a second Linux with three NICs?

If it can be done with one Linux box and a switch, the I can get the whole
package (DMZ firewall, VLAN-support, VPN, etc) for some $600. The total
power consumption would be around 40 watt (Linux+switch). As green as
it gets :-)

Have anyone done anything similar?

Regards, Bo Svensson

Reply

37 audio rodriguez October 2, 2010 at 8:56 pm

how i do vlan with vconfig in windows ?

Reply

38 Thomas October 22, 2010 at 12:17 pm

With your HowTo:

Box1:
# vconfig add eth0 5
# ifconfig vlan5 10.0.0.1/24

Box2:
# vconfig add eth0 5
# ifconfig vlan5 10.0.0.2/24

If both boxes are connected to the same network, I’d assume pinging from one to the other shall work:
Box1:
# ping 10.0.0.1
PING 10.0.0.1 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_req=1 ttl=64 time=0.037 ms
64 bytes from 10.0.0.1: icmp_req=2 ttl=64 time=0.021 ms
^C

# ping 10.0.0.2
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
From 10.0.0.2 icmp_seq=1 Destination Host Unreachable
From 10.0.0.2 icmp_seq=2 Destination Host Unreachable
From 10.0.0.2 icmp_seq=3 Destination Host Unreachable
^C

Routing is set up OK on both boxes:
Box1:
# route
Kernel-IP-Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
10.0.0.0 * 255.255.255.0 U 0 0 0 vlan5

Box2:
# route
Kernel-IP-Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
10.0.0.0 * 255.255.255.0 U 0 0 0 vlan5

Since there is nothing than a little, unmanageable switch in between these two hosts …

Reply

39 venky February 24, 2011 at 6:39 am

Regarding Ethernet switch,
If I have to configure two VLANs with VID = 3700 and 3800, what value do I put in field FID, since it is only 7 bit and cannot contain the above mentioned VIDs

Reply

40 Vaerer July 1, 2011 at 9:42 am

“My VLAN ID is 5. So I need to copy file /etc/sysconfig/network-scripts/ifcfg-eth0 to /etc/sysconfig/network-scripts/ifcfg-eth0.5″

What is a VLAN ID? How do you know what your VLAN ID is?

Reply

41 grace owiny July 13, 2011 at 7:09 am

hey please send me the commands for configuring vlan on cisco switches. i am using packet tracer a software for this.thanx

Reply

42 Garvit February 10, 2012 at 7:24 pm

Very helpful information.
Working fine :)

Reply

43 Bipin April 22, 2012 at 9:45 am

You need to add the following line inside the VLAN interface.

TYPE=Ethernet

Otherwise the physical switch cannot understand the VLAN through its handshake.

Reply

44 yikee April 27, 2012 at 2:51 am

Hi, If i would like to create few VLAN in 1 PC with different ID and let others PC connect to it?? It is possible?? How others PC connect to the VLAN that i created??

Reply

45 yikee April 27, 2012 at 3:29 am

Hi, How i detect whether others Pc already connected to the VLAN that i had created??

Reply

46 anil May 30, 2012 at 11:25 am

Hi all
please send me steps about “Nagios Quick-start” configuration on fedora OS …

Thanks

Reply

47 John Nelson October 4, 2012 at 4:18 pm

Instructions for setting up, under CentOS, a virtual interface that will tag it’s packets for VLAN(x) work as advertised.. Thanks for sharing.

Reply

48 Ben Watson June 10, 2013 at 8:20 am

A fantastic tutorial. The vconfig utility works perfectly for me – thank you very much.

Reply

49 anonymous IT person July 8, 2013 at 3:10 pm

This all sounds pretty good so far. I use the dhcpd.conf file on Centos to assign static IP addresses to the different devices.. Will I be able to do the same thing on a VLAN setup? Will I be able to assign the vlan IP addresses to their respective devices?

Reply

50 Manoz Karmacharya February 17, 2014 at 4:49 pm

I used vconfig to add VlAN to CentOS 6.5. But in every reboot, all the vlan configuration gets erased.

Reply

51 Joe Dakine February 26, 2014 at 11:54 pm

You have an error in your ifcfg-eth0.5 config file:
What you have: DEVICE=ifcfg-eth0.5
What is should be: DEVICE=eth0.5

Reply

52 NIX Craft February 27, 2014 at 8:56 am

Thanks for the heads up. The blog post has been updated.

Reply

Leave a Comment

Tagged as: , , , , , , , , , , , , , , , ,

Previous post:

Next post: