HowTo: Configure Linux Virtual Local Area Network (VLAN)

Posted on in Categories CentOS, Debian Linux, Gentoo Linux, Hardware, Linux, Networking, RedHat/Fedora Linux, Ubuntu Linux last updated June 6, 2006

VLAN is an acronym for Virtual Local Area Network. Several VLANs can co-exist on a single physical switch, which are configured via Linux software and not through hardware interface (you still need to configure actual hardware switch too).

Hubs or switch connects all nodes in a LAN and node can communicate without a router. For example, all nodes in LAN A can communicate with each other without the need for a router. If a node from LAN A wants to communicate with LAN B node, you need to use a router. Therefore, each LAN (A, B, C and so on) are separated using a router.

VLAN as a name suggest combine multiple LANs at once. But, what are the advantages of VLAN?

  • Performance.
  • Ease of management.
  • Security.
  • Trunks.
  • VLANs give you the ability to sub-divide a LAN for security purpose.
  • You don’t have to configure any hardware device, when physically moving server computer to another location and more.

Fundamental discussion about VLAN or switches is beyond the scope of this blog post. I suggest the following textbooks:

A note about your LAN hardware

  1. To be able to use VLANs you will need a switch that support the IEEE 802.1q standard on an Ethernet network.
  2. You will also need a NIC (Network Interface Card) that works with Linux and support 802.1q standard .

Linux VLAN configuration issues

I am lucky enough to get a couple of hints from our internal wiki:

  • Not all network drivers support VLAN. You may need to patch your driver.
  • MTU may be another problem. VLAN works by tagging each frame i.e. an Ethernet header extension that enlarges the header from 14 to 18 bytes. The VLAN tag contains the VLAN ID and priority.
  • Do not use VLAN ID 1 as it may be used for admin purpose.

Enough talk, let’s get to the Linux VLAN configurations.

Setting up 802.1q VLAN tagging by loading 8021q Linux kernel driver

First, make sure that the Linux kernel driver (module) called 8021q is loaded:
# lsmod | grep 8021q
If the module is not loaded, load it with the following modprobe command:
# modprobe 8021q

Method #1: CentOS/RHLE/Fedora Linux VLAN HowTo

I am using RHEL/CentOS Linux with VLAN ID # 5. So I need to copy file /etc/sysconfig/network-scripts/ifcfg-eth0 to /etc/sysconfig/network-scripts/ifcfg-eth0.5
# cp /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0.5
Now, I’ve one network card (eth0) and it needs to tagged network traffic for VLAN ID 5.

  • eth0 – Your regular network interface
  • eth0.5 – Your virtual interface that use untagged frames

Do not modify /etc/sysconfig/network-scripts/ifcfg-eth0 file. Now open file /etc/sysconfig/network-scripts/ifcfg-eth0.5 using a text editor such as vi, type:
# vi /etc/sysconfig/network-scripts/ifcfg-eth0.5
Find DEVICE=eth0 line and replace with:
DEVICE=eth0.5
Also, append the following line:
VLAN=yes
Make sure you assign correct IP address using DHCP or static IP. Remove gateway entry from all other network config files. Only add gateway to /etc/sysconfig/network file. This whole configuration may sound complicated. So I am including sample configurations files for you:

/etc/sysconfig/network-scripts/ifcfg-eth0.5 file

# VLAN configuration for my eth0  with ID - 5 #
DEVICE=eth0.5
BOOTPROTO=none
ONBOOT=yes
IPADDR=192.168.1.5
NETMASK=255.255.255.0
USERCTL=no
NETWORK=192.168.1.0
VLAN=yes

/etc/sysconfig/network-scripts/ifcfg-eth0 file

# Actual configuration for my eth0 physical interface ##
DEVICE=eth0
TYPE=Ethernet
BOOTPROTO=none
ONBOOT=yes

Finally, restart networking service on a CentOS/RHEL/Fedora Linux, type:
# /etc/init.d/network restart
OR
# service network restart

NOTE: If you need a second VLAN i.e. you need to configure for VLAN ID 2 then copy the /etc/sysconfig/network-scripts/ifcfg-eth0 to /etc/sysconfig/network-scripts/ifcfg-eth0.2 and do the above procedure again.

Method #2: Using the vconfig command

Above method is perfect and works with a Red hat Enterprise Linux / CentOS / Fedora Linux without any problem. However, you will notice that there is a command called vconfig. The vconfig program allows you to create and remove vlan-devices on a vlan enabled kernel. Vlan-devices are virtual Ethernet devices which represents the virtual lans on the physical lan. This is yet another method of configuring VLAN. To add VLAN ID 5 with following command for eth0 interface:
# vconfig add eth0 5
The vconfig add command creates a vlan-device on eth0 which result into eth0.5 interface. You can use normal ifconfig command to see device information:
# ifconfig eth0.5
Use ifconfig command to assign IP address to vlan interfere:
# ifconfig eth0.5 192.168.1.100 netmask 255.255.255.0 broadcast 192.168.1.255 up
To get detailed information about VLAN interface, type:
# cat /proc/net/vlan/eth0.5
If you wish to delete VLAN interface use delete command as follows:
# ifconfig eth0.5 down
# vconfig rem eth0.5

See vconfig(8) for more information on syntax and examples.

Method #3: Create the VLAN device using the ip command

Use the ip command as follows for the interface eth0, and the vlan id is 5:
# ip link add link eth0 name eth0.5 type vlan id 5
# ip link
# ip -d link show eth0.5

You need to activate and add an IP address to vlan link, type:
# ip addr add 192.168.1.200/24 brd 192.168.1.255 dev eth0.5
# ip link set dev eth0.5 up

All traffic will go through the eth0 interface bith with a BLAN tag 5. Only VLAN aware devices can accept the traffic, otherwise the traffic is dropped.

How can I remove VLAN ID 5?

Type the following commands
# ip link set dev eth0.5 down
# ip link delete eth0.5

How do I make above VLAN configuration permanent on a Debian or Ubuntu based system?

Edit the /etc/network/interfaces file, enter:
$ sudo vi /etc/network/interfaces
Update configuration as follows:

## vlan for eth0 with ID - 5 on a Debian/Ubuntu Linux##
auto eth0.5
iface eth0.5 inet static
    address 192.168.1.200
    netmask 255.255.255.0
    vlan-raw-device eth0

Save and close the file.

See also
  • Man pages – ip(8),vconfig(8),ifconfig(8)

# Additional correction by John T and others; Editing by VG – log #

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin and a trainer for the Linux operating system/Unix shell scripting. He has worked with global clients and in various industries, including IT, education, defense and space research, and the nonprofit sector. Follow him on Twitter, Facebook, Google+.

56 comment

  1. A VLAN is a logical grouping of two or more servers which are not necessarily on the same physical network segment but which share the same IP network subnet. The advantage to passing traffic across a VLAN versus a LAN is that information on one VLAN can only be seen on that VLAN, and not by every server on the entire LAN. This is especially beneficial when you have many different nodes on a network sharing information with each other.

    Most web server hosting companies deploys some sort of VLAN to protect customers.

    1. Do you know if i can create vlans over vlans. Let me explain myself:

      I have a vmware linux virtual machine with 2 “virtual physical ” interfaces (eth0 and eth1) virtual eth0 is bridged to the laptop eth0 physical interface and virtual eth1 is bridged to a eth0.172 virtual interface in the vlan 172. All these connected to the switch port … untagged for VLAN 1 and tagged for VLAN 172. I need to create a VLAN 1010 over the virtual eth1 inside the virtual machine to communicate to the vlan 1010 in the switch.

      Can that be possible?

  2. A VLAN is a “Virtual Local Area Network” and is present in L2 (Level 2) of the protocal stack. The above postings may be misleading in that the word “server” is used rather than “host”.

    A host may be a server, workstation or other device which conforms to 802.1q specification. Therefore, it is possible (with certain limitations) to attach a laptop to a VLAN seen by a server.

    802.1q provides for an additional 4-bytes of information added to the L2 frame, 12 bits of which indicate the VLAN is. Thus one may have 4K VLANs.

    When you want to configure a VLAN in Linux, assuming your kernel supports it (2.6+ do) you need to make sure 802.1q support is available. This is most easily done with modprobe. So the command:

    /sbin/modprobe 8021q

    should do the trick.

    Then, for any given NIC interface you only have to do the following:

    /sbin/vconfig add eth
    /sbin/ifconfig eth. 192.168.0.x netmask 255.255.255.0

    Of course I just picked some arbitrary class C address, you would have to use what is appropriate for you.

    You may need then to add to the routing table (not knowing what Linux you are running) something like:

    /sbin/route add -net 192.168.0.0 netmask 255.255.255.0 eth.

    ALL THE ABOVE MUST BE AS ROOT.

  3. Hi, I’ve configure a repotec switch with vlans 802.1q and my pc with Ubuntu(my router) to use vlan tagged protocol.
    It works fine for Internet navigation, but I can’t access to web pages on my Ubuntu server.

    I’ve look in some forums and in google but I haven’t found nothing.

    Somebody can help me?

    Thanks

  4. Here is my problem.

    Office 1 has 3 networks (VLAN port-based)
    Office 2 is 500′ away with a switch in the middle and only one cat5 cable

    I’m trying to find a way to convert port-based vlan to TAG (IEEE 802.1Q or similar )

    Ex: On a x86 with linux or wrt54g

    Port1 = Lan #1 => Tag #1 on port4
    Port2 = Lan #2 => Tag #1 on port4
    Port3 = Lan #3 => Tag #1 on port4

    port4 got to the other wrt54g on port4

    on the other device

    port4 (tag #1) => Port1
    port4 (tag #2) => Port2
    port4 (tag #3) => Port3

    So basicly is how to tag a incomming packet on port x and untag once on the other side.
    The routing part is almost simple.

    Eric

  5. I was looking for a site to explain this in plain english and i found it! thank god! 🙂

    a few questions:
    1st, how can i configure the system so everything takes a dhcp address once the system initializes? Should i configure a dhcp server so that when a computer starts it will send a DHCP request? How can i setup a dhcp server to give different ip address ranges to different VLANS? If i am trying to access a resource from within a vlan, will i need a dns server internally to translate the domain name (if used) to the different ip addresses a device will have?

    thanks!

  6. Sir,
    I have followed the steps mentioned in “How to configure VLAN in LINUX”. I am using fedora 7.
    although I am able to configure VLAN but I am not able to ping it to my client computer and vice versa.
    If I don’t configure vlan then everything works fine on this interface i.e. eth1.
    Kindly provide me with some solution.

  7. Hi everyone,

    is it possible to do “one dhcp server using multiple vlan’s”? does anyone successfully do this? Please let us know howto.

    Thank you.

  8. “one dhcp server using multiple vlan’s”
    I’d presume you change /etc/sysconfig/dhcpd file
    specify which virtual adaptors you want the dhcpd service to runon “eth0 eth1 eth1.10” would be ethernet if 0, 1, and vlan 10 on eth1. Thats where I’d start. Though you may have a lot of….er..fun if you dont have an injection of which vlan is making the request they’ll all get the same pool. (option 82 enabled devices)

  9. Hi,

    is there any way to find out that whether systems are connected under physical or virtual LAN’s?

    please tell me know …

  10. I have configured valn in two linux machines with vlan id 4. Ping is working between the virtual interfaces but the ping packets have no tag attached.

    I anyone have some idea please share..

    Thanks

  11. i have xp in my system but i wanna install ubundu Linux on it by virtual machine but it running till when it display one error after that it need additional virtual machine it cant be go ahead give me salvations how it ll be install on xp plz

  12. Ye,after reading this topic,I learn a lot.So first,say thanks everyone.
    Back to this topic,I have a question.
    At say of topic owner,”an Ethernet header extension that enlarges the header from 14 to 18 bytes”,what means? I capture a frame. A Ethernet header contains destination,source,type fields.(I use adsl).And en-largeing above means add a field at Ethernet header,or add one in other place?
    My Goal is building a experiment environment for network communication. It will be a complex one.It contains hundreds nodes with multiple topology structures.
    Could someone give me a hand?And is vlan OK for it?If not,which can?

  13. Hey folks,

    I have a couple of questions:

    1.If i want to copy a file from my windows desktop to my linux (RHEL 4.0) virtual machine, how should i do it?

    2.How can i assign ip address to my virtual machine?

    Thanks
    NSiva

  14. Hi All,

    Very very basic question, for configuring VLAN in Linux is that necessary to have a manageable switches ??

    Thanks,
    Sathish

  15. Can you give me the whole codes for virtual lan. and there should be browser and it should allow us to access a file from another ip address and it should allow copy, paste, save, open commands in that programm for that access file.

  16. hey folks
    how can i configure the vlan priority bits on the ethernet header…it wud be of gr8 help if ne1 could provide som inputs on this

    regards
    Arun

  17. In the above test I have seen the statement like “Remove gateway entry from all other network config files.” How can I find the places where the gateway is configured on the system ?

    Please let me know how can I test my vlan config using one single Linux PC ?

  18. A working configuration example from [email protected]

    Server ip : 172.27.0.10
    Swtich ip / gateway ip of server : 172.27.0.100
    Option domain –name servers : 172.27.0.6

    Please note default vlan 172.27.0.x in this case

    Switch and server need to be in default lan for communication / or else we need to trunk in case other vlan connected , we need to configure vconfig on server to communicate

    For biggner I would recommend to go for the default vlan connectivity

    Example :

    ddns-update-style interim;
    ignore client-updates;
    default-lease-time 43200;
    max-lease-time 43200;
    authoritative;
    
    
    #-----subnet mask-- broadcast-- gateway-#
    
    option subnet-mask 255.255.255.0;
    #option broadcast-address 192.168.1.1;
    option routers 172.27.0.100;
    option domain-name-servers 172.27.0.6;
    
    
    # ----------- Server Scope and vlan1 with switches and server--------------#
    subnet 172.27.0.0 netmask 255.255.255.0 {
    #range 172.27.0.0 172.27.0.50;
    option routers 172.27.0.1;
    #option subnet-mask 255.255.255.0;
    option broadcast-address 172.27.0.255;
    #option domain-name-servers 172.27.0.5;
    }
    
    
    # ----------- clients1 Scope-vlan2-------------#
    subnet 172.27.1.0 netmask 255.255.255.0 {
    range 172.27.1.3 172.27.1.200;
    option routers 172.27.1.1;
    option subnet-mask 255.255.255.0;
    option broadcast-address 172.27.1.255;
    #option domain-name-servers 192.168.1.1 #
    }
    
    Save the file
    
    Chkconfig –list dhcpd on

    { For enabling the service on all run levels }
    Service dhcpd start
    In case , dhcp server faild to start , check with log messages

    /var/log/messages

    Check for the ip helper address in layer 3 swtich , which act as dhcp-relay
    Which has to be configured as 172.27.0.10

    Troubleshooting Dhcp server start up error :

    1) Run the Dhcp service in debug mode
    2) Check the ip configuration
    3) Check for syntax errors in dhcpd.conf file
    4) Check for the right location of the dhcpd file
    5) Ping test between the switch and server
    6) Possible conflict of other dhcp server may be the issue

    dhcpd in the foreground in debug mode with /usr/sbin/dhcpd -d –f

    Hopefully, a DHCP server like the one we’ll be configuring will respond. Running tcpdump shows a dhcp request looks like:
    17:26:02.003956 00:00:00:00:00:00 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0×0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request, length 300
    You should notice DHCP running in the process (ps) list. Any problems, check syslog

    Congratulations you have finally configured In easy steps

  19. Hi,
    I have just installed rh5 in a Xen server. I have attached a vlan to the virtual rh5 server.
    The problem is I am unable to view any interface. I see only loop back device.
    I have even tried modprobe 8021q but still no success.
    I am using 2.6.18-92.el5xen kernal.
    Any help would be great

  20. hi all

    we are on a VLAN Network my issue is on the dhcpd.conf side coz wana configure My opensuse 11 box to serve ip’s (DHCP Server) on diffrent VLAN , Wana Replace our Windows DHCP Server for some Technical Reasons , my susebux has only one phsysical Network interface , is this possible to serve all VLAN? iphelper is already confgured on our L3 Switches , actually OUr Windows DHCP Server is already runnning and serving this vlans , but i just wana replace it with linux

    is this a dhcpd issue to vconfig?

    heres is our VLAN Scheme

    Dept.1

    VLAN # xx
    Range : 192.168.24.xxx-xxx

    Dept.2
    VLAN # xx
    Range : 192.168.24.xxx – xxx

    Dept.3
    VLAN # xx
    Range : 192.168.24.xxx-xxx

    Dept.4
    VLAN #xx
    Range : 192.168.24.xxx-xxx

    Dept. 5
    VLAN # xx
    Range 192.168.20.xxx.xxx

  21. Hi all!
    I want to set up a functionality rich, cost efficient, energy efficient, network like this:
    – A Linux box (e.g. based on a Mini-ITX with one NIC),
    connected to a managed switch (with VLAN support, like DES-3010GA).
    The link between Linux box and switch will be only tagged (all VLAN:s).
    On the switch I want untagged VLAN:s, like “internet”, “DMZ” and “LAN”.

    My question: Can the Linux box be both VLAN manager and router (replace
    a Level 3 switch) and firewall or do I need a second Linux with three NICs?

    If it can be done with one Linux box and a switch, the I can get the whole
    package (DMZ firewall, VLAN-support, VPN, etc) for some $600. The total
    power consumption would be around 40 watt (Linux+switch). As green as
    it gets 🙂

    Have anyone done anything similar?

    Regards, Bo Svensson

  22. With your HowTo:

    Box1:
    # vconfig add eth0 5
    # ifconfig vlan5 10.0.0.1/24

    Box2:
    # vconfig add eth0 5
    # ifconfig vlan5 10.0.0.2/24

    If both boxes are connected to the same network, I’d assume pinging from one to the other shall work:
    Box1:
    # ping 10.0.0.1
    PING 10.0.0.1 (10.0.0.2) 56(84) bytes of data.
    64 bytes from 10.0.0.1: icmp_req=1 ttl=64 time=0.037 ms
    64 bytes from 10.0.0.1: icmp_req=2 ttl=64 time=0.021 ms
    ^C

    # ping 10.0.0.2
    PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
    From 10.0.0.2 icmp_seq=1 Destination Host Unreachable
    From 10.0.0.2 icmp_seq=2 Destination Host Unreachable
    From 10.0.0.2 icmp_seq=3 Destination Host Unreachable
    ^C

    Routing is set up OK on both boxes:
    Box1:
    # route
    Kernel-IP-Routentabelle
    Ziel Router Genmask Flags Metric Ref Use Iface
    10.0.0.0 * 255.255.255.0 U 0 0 0 vlan5

    Box2:
    # route
    Kernel-IP-Routentabelle
    Ziel Router Genmask Flags Metric Ref Use Iface
    10.0.0.0 * 255.255.255.0 U 0 0 0 vlan5

    Since there is nothing than a little, unmanageable switch in between these two hosts …

  23. Regarding Ethernet switch,
    If I have to configure two VLANs with VID = 3700 and 3800, what value do I put in field FID, since it is only 7 bit and cannot contain the above mentioned VIDs

  24. “My VLAN ID is 5. So I need to copy file /etc/sysconfig/network-scripts/ifcfg-eth0 to /etc/sysconfig/network-scripts/ifcfg-eth0.5”

    What is a VLAN ID? How do you know what your VLAN ID is?

  25. hey please send me the commands for configuring vlan on cisco switches. i am using packet tracer a software for this.thanx

  26. You need to add the following line inside the VLAN interface.

    TYPE=Ethernet

    Otherwise the physical switch cannot understand the VLAN through its handshake.

  27. Hi, If i would like to create few VLAN in 1 PC with different ID and let others PC connect to it?? It is possible?? How others PC connect to the VLAN that i created??

  28. Hi all
    please send me steps about “Nagios Quick-start” configuration on fedora OS …

    Thanks

  29. Instructions for setting up, under CentOS, a virtual interface that will tag it’s packets for VLAN(x) work as advertised.. Thanks for sharing.

  30. A fantastic tutorial. The vconfig utility works perfectly for me – thank you very much.

  31. This all sounds pretty good so far. I use the dhcpd.conf file on Centos to assign static IP addresses to the different devices.. Will I be able to do the same thing on a VLAN setup? Will I be able to assign the vlan IP addresses to their respective devices?

  32. I used vconfig to add VlAN to CentOS 6.5. But in every reboot, all the vlan configuration gets erased.

  33. You have an error in your ifcfg-eth0.5 config file:
    What you have: DEVICE=ifcfg-eth0.5
    What is should be: DEVICE=eth0.5

  34. Thanks for your post.
    The method #2 is temporary and it’s like adding route because after restarting the server, it will be deleted and must be added again. right?

  35. Can this be used if i want to plumb different segment IP’s as virtual IP addresses under same single NIC. If not, suggest how the communication can be achieved between these?

    For e.g
    eth0 192.X.X.108/27
    eth0:0 192.X.X.110/27
    eth0:1 10.X.X.X/24
    eth0:2 10.X.X.X/24

  36. Hi nixCraft, I am facing vlan config problem. Please help me!!!

    Here is my set-up:
    -> Installed OS (rhel7) on my hp server
    -> Hp server contain 4 Physical NIC cards. (eno1, eno2, eno3 & eno4)
    -> I bonded eno2 & eno3 and created bond0
    -> Now I created vlans from bond0 (bond0.100, bond0.200 & bond0.300)
    -> I renamed these vlan’s to bond0.100 -> eth0 / bond0.200 -> eth1 & bond0.300 -> eth2
    -> I assigned 172.17.1.2 series to eth0 vlan / 172.16.1.2 series to eth1 vlan
    -> Now I created bridges (eth0br, eth1br & eth3br)
    -> Now I mapped each one (eth0 -> eth0br / eth1-> eth1br / eth2 -> eth2br)
    -> Now I created VM
    -> I got eth0, eth1 and eth2 on the VM side
    -> I assigned eth0 to 172.17.1.100 and for eth1 to 172.16.1.100
    -> But when I ping from 172.17.1.2, I’m getting Host Unreachable error

    Please let me know what I’m doing wrong here

    Thanks
    -Vijay

  37. Hello. I am a student who studies Ethernet communication.
    I have a question about VLAN support.
    Even if a device does not have Ethernet switch which support 802.1Q, is it possible to implement VLAN by using Linux?

    Thank you.

Comments are closed.