HowTo: Configure Linux Virtual Local Area Network (VLAN)

VLAN is an acronym for Virtual Local Area Network. Several VLANs can co-exist on a single physical switch, which are configured via Linux software and not through hardware interface (you still need to configure actual hardware switch too).

Hubs or switch connects all nodes in a LAN and node can communicate without a router. For example, all nodes in LAN A can communicate with each other without the need for a router. If a node from LAN A wants to communicate with LAN B node, you need to use a router. Therefore, each LAN (A, B, C and so on) are separated using a router.

VLAN as a name suggest combine multiple LANs at once. But, what are the advantages of VLAN?

  • Performance.
  • Ease of management.
  • Security.
  • Trunks.
  • VLANs give you the ability to sub-divide a LAN for security purpose.
  • You don’t have to configure any hardware device, when physically moving server computer to another location and more.

Fundamental discussion about VLAN or switches is beyond the scope of this blog post. I suggest the following textbooks:

A note about your LAN hardware

  1. To be able to use VLANs you will need a switch that support the IEEE 802.1q standard on an Ethernet network.
  2. You will also need a NIC (Network Interface Card) that works with Linux and support 802.1q standard .

Linux VLAN configuration issues

I am lucky enough to get a couple of hints from our internal wiki:

  • Not all network drivers support VLAN. You may need to patch your driver.
  • MTU may be another problem. VLAN works by tagging each frame i.e. an Ethernet header extension that enlarges the header from 14 to 18 bytes. The VLAN tag contains the VLAN ID and priority.
  • Do not use VLAN ID 1 as it may be used for admin purpose.

Enough talk, let’s get to the Linux VLAN configurations.

Setting up 802.1q VLAN tagging by loading 8021q Linux kernel driver

First, make sure that the Linux kernel driver (module) called 8021q is loaded:
# lsmod | grep 8021q
If the module is not loaded, load it with the following modprobe command:
# modprobe 8021q

Method #1: CentOS/RHLE/Fedora Linux VLAN HowTo

I am using RHEL/CentOS Linux with VLAN ID # 5. So I need to copy file /etc/sysconfig/network-scripts/ifcfg-eth0 to /etc/sysconfig/network-scripts/ifcfg-eth0.5
# cp /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0.5
Now, I’ve one network card (eth0) and it needs to tagged network traffic for VLAN ID 5.

  • eth0 – Your regular network interface
  • eth0.5 – Your virtual interface that use untagged frames

Do not modify /etc/sysconfig/network-scripts/ifcfg-eth0 file. Now open file /etc/sysconfig/network-scripts/ifcfg-eth0.5 using a text editor such as vi, type:
# vi /etc/sysconfig/network-scripts/ifcfg-eth0.5
Find DEVICE=eth0 line and replace with:
Also, append the following line:
Make sure you assign correct IP address using DHCP or static IP. Remove gateway entry from all other network config files. Only add gateway to /etc/sysconfig/network file. This whole configuration may sound complicated. So I am including sample configurations files for you:

/etc/sysconfig/network-scripts/ifcfg-eth0.5 file

# VLAN configuration for my eth0  with ID - 5 #

/etc/sysconfig/network-scripts/ifcfg-eth0 file

# Actual configuration for my eth0 physical interface ##

Finally, restart networking service on a CentOS/RHEL/Fedora Linux, type:
# /etc/init.d/network restart
# service network restart

NOTE: If you need a second VLAN i.e. you need to configure for VLAN ID 2 then copy the /etc/sysconfig/network-scripts/ifcfg-eth0 to /etc/sysconfig/network-scripts/ifcfg-eth0.2 and do the above procedure again.

Method #2: Using the vconfig command

Above method is perfect and works with a Red hat Enterprise Linux / CentOS / Fedora Linux without any problem. However, you will notice that there is a command called vconfig. The vconfig program allows you to create and remove vlan-devices on a vlan enabled kernel. Vlan-devices are virtual Ethernet devices which represents the virtual lans on the physical lan. This is yet another method of configuring VLAN. To add VLAN ID 5 with following command for eth0 interface:
# vconfig add eth0 5
The vconfig add command creates a vlan-device on eth0 which result into eth0.5 interface. You can use normal ifconfig command to see device information:
# ifconfig eth0.5
Use ifconfig command to assign IP address to vlan interfere:
# ifconfig eth0.5 netmask broadcast up
To get detailed information about VLAN interface, type:
# cat /proc/net/vlan/eth0.5
If you wish to delete VLAN interface use delete command as follows:
# ifconfig eth0.5 down
# vconfig rem eth0.5

See vconfig(8) Linux man page for more information on syntax and examples.

Method #3: Create the VLAN device using the ip command

Use the ip command as follows for the interface eth0, and the vlan id is 5:
# ip link add link eth0 name eth0.5 type vlan id 5
# ip link
# ip -d link show eth0.5

You need to activate and add an IP address to vlan link, type:
# ip addr add brd dev eth0.5
# ip link set dev eth0.5 up

All traffic will go through the eth0 interface bith with a BLAN tag 5. Only VLAN aware devices can accept the traffic, otherwise the traffic is dropped.

How can I remove VLAN ID 5?

Type the following commands
# ip link set dev eth0.5 down
# ip link delete eth0.5

How do I make above VLAN configuration permanent on a Debian or Ubuntu based system?

Edit the /etc/network/interfaces file, enter:
$ sudo vi /etc/network/interfaces
Update configuration as follows:

## vlan for eth0 with ID - 5 on a Debian/Ubuntu Linux##
auto eth0.5
iface eth0.5 inet static
    vlan-raw-device eth0

Save and close the file.

See also
  • Man pages – ifconfig(8)

# Additional correction by John T and others; Editing by VG – log #

🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 56 comments so far... add one
CategoryList of Unix and Linux commands
Disk space analyzersncdu pydf
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
56 comments… add one
  • Ted Jun 7, 2006 @ 20:02

    A VLAN is a logical grouping of two or more servers which are not necessarily on the same physical network segment but which share the same IP network subnet. The advantage to passing traffic across a VLAN versus a LAN is that information on one VLAN can only be seen on that VLAN, and not by every server on the entire LAN. This is especially beneficial when you have many different nodes on a network sharing information with each other.

    Most web server hosting companies deploys some sort of VLAN to protect customers.

    • Edgar Ramirez Sep 9, 2011 @ 17:31

      Do you know if i can create vlans over vlans. Let me explain myself:

      I have a vmware linux virtual machine with 2 “virtual physical ” interfaces (eth0 and eth1) virtual eth0 is bridged to the laptop eth0 physical interface and virtual eth1 is bridged to a eth0.172 virtual interface in the vlan 172. All these connected to the switch port … untagged for VLAN 1 and tagged for VLAN 172. I need to create a VLAN 1010 over the virtual eth1 inside the virtual machine to communicate to the vlan 1010 in the switch.

      Can that be possible?

  • anoop Jun 27, 2006 @ 18:25

    plese send me how to configure vlan in linux

  • 🐧 nixCraft Jun 28, 2006 @ 0:02

    err .. sorry i just forgot to add Instructions as I am busy on some other work.. I will add them possibly by tomorrow

  • Bill Aug 14, 2006 @ 2:41

    A VLAN is a “Virtual Local Area Network” and is present in L2 (Level 2) of the protocal stack. The above postings may be misleading in that the word “server” is used rather than “host”.

    A host may be a server, workstation or other device which conforms to 802.1q specification. Therefore, it is possible (with certain limitations) to attach a laptop to a VLAN seen by a server.

    802.1q provides for an additional 4-bytes of information added to the L2 frame, 12 bits of which indicate the VLAN is. Thus one may have 4K VLANs.

    When you want to configure a VLAN in Linux, assuming your kernel supports it (2.6+ do) you need to make sure 802.1q support is available. This is most easily done with modprobe. So the command:

    /sbin/modprobe 8021q

    should do the trick.

    Then, for any given NIC interface you only have to do the following:

    /sbin/vconfig add eth
    /sbin/ifconfig eth. 192.168.0.x netmask

    Of course I just picked some arbitrary class C address, you would have to use what is appropriate for you.

    You may need then to add to the routing table (not knowing what Linux you are running) something like:

    /sbin/route add -net netmask eth.


  • Samarendra Saha Sep 13, 2006 @ 12:16

    How can config IP addressing in Suse linux? Please send me the path to adding the IP address and make a work group.

  • viswanathsingh Sep 13, 2006 @ 13:17

    could you pleasesend me the instructions for setting up the VLAN

  • 🐧 nixCraft Sep 13, 2006 @ 19:05


    Instructions/commands are mentioned above. Please read the vconfig and VLAN config section.

  • 🐧 nixCraft Sep 13, 2006 @ 19:07


    Run yast or yast2 command to change network configuration under Suse Linux.


  • viswanath Sep 14, 2006 @ 15:54

    Any one is having idea how to test VTUN

  • viswanath Sep 14, 2006 @ 15:55

    how to test VLAN (i want to know basic scenario)

  • Luigi Jan 31, 2007 @ 8:58

    Hi, I’ve configure a repotec switch with vlans 802.1q and my pc with Ubuntu(my router) to use vlan tagged protocol.
    It works fine for Internet navigation, but I can’t access to web pages on my Ubuntu server.

    I’ve look in some forums and in google but I haven’t found nothing.

    Somebody can help me?


  • sai kris Jun 3, 2007 @ 17:07

    how to add loopback adapter in rhel 4.0

  • Eric Arnaud Jul 3, 2007 @ 3:24

    Here is my problem.

    Office 1 has 3 networks (VLAN port-based)
    Office 2 is 500′ away with a switch in the middle and only one cat5 cable

    I’m trying to find a way to convert port-based vlan to TAG (IEEE 802.1Q or similar )

    Ex: On a x86 with linux or wrt54g

    Port1 = Lan #1 => Tag #1 on port4
    Port2 = Lan #2 => Tag #1 on port4
    Port3 = Lan #3 => Tag #1 on port4

    port4 got to the other wrt54g on port4

    on the other device

    port4 (tag #1) => Port1
    port4 (tag #2) => Port2
    port4 (tag #3) => Port3

    So basicly is how to tag a incomming packet on port x and untag once on the other side.
    The routing part is almost simple.


  • George Jul 26, 2007 @ 19:20

    I was looking for a site to explain this in plain english and i found it! thank god! 🙂

    a few questions:
    1st, how can i configure the system so everything takes a dhcp address once the system initializes? Should i configure a dhcp server so that when a computer starts it will send a DHCP request? How can i setup a dhcp server to give different ip address ranges to different VLANS? If i am trying to access a resource from within a vlan, will i need a dns server internally to translate the domain name (if used) to the different ip addresses a device will have?


  • Vivek Oct 13, 2007 @ 12:53

    I have followed the steps mentioned in “How to configure VLAN in LINUX”. I am using fedora 7.
    although I am able to configure VLAN but I am not able to ping it to my client computer and vice versa.
    If I don’t configure vlan then everything works fine on this interface i.e. eth1.
    Kindly provide me with some solution.

  • fsmendoza Nov 29, 2007 @ 15:47

    Hi everyone,

    is it possible to do “one dhcp server using multiple vlan’s”? does anyone successfully do this? Please let us know howto.

    Thank you.

  • csmith Jan 11, 2008 @ 23:21

    “one dhcp server using multiple vlan’s”
    I’d presume you change /etc/sysconfig/dhcpd file
    specify which virtual adaptors you want the dhcpd service to runon “eth0 eth1 eth1.10” would be ethernet if 0, 1, and vlan 10 on eth1. Thats where I’d start. Though you may have a lot of… if you dont have an injection of which vlan is making the request they’ll all get the same pool. (option 82 enabled devices)

  • Gagan Feb 28, 2008 @ 14:36


    is there any way to find out that whether systems are connected under physical or virtual LAN’s?

    please tell me know …

  • Bincy Mar 19, 2008 @ 8:35

    I have configured valn in two linux machines with vlan id 4. Ping is working between the virtual interfaces but the ping packets have no tag attached.

    I anyone have some idea please share..


  • ubaid Jun 11, 2008 @ 20:22

    i have xp in my system but i wanna install ubundu Linux on it by virtual machine but it running till when it display one error after that it need additional virtual machine it cant be go ahead give me salvations how it ll be install on xp plz

  • after reading,there are some question Jun 20, 2008 @ 21:46

    Ye,after reading this topic,I learn a lot.So first,say thanks everyone.
    Back to this topic,I have a question.
    At say of topic owner,”an Ethernet header extension that enlarges the header from 14 to 18 bytes”,what means? I capture a frame. A Ethernet header contains destination,source,type fields.(I use adsl).And en-largeing above means add a field at Ethernet header,or add one in other place?
    My Goal is building a experiment environment for network communication. It will be a complex one.It contains hundreds nodes with multiple topology structures.
    Could someone give me a hand?And is vlan OK for it?If not,which can?

  • shirish Jul 17, 2008 @ 9:30

    very Helpful

  • D Sep 26, 2008 @ 17:49

    It worked

  • siva Nov 14, 2008 @ 8:33

    Hey folks,

    I have a couple of questions:

    1.If i want to copy a file from my windows desktop to my linux (RHEL 4.0) virtual machine, how should i do it?

    2.How can i assign ip address to my virtual machine?


  • dekkard Dec 25, 2008 @ 6:04

    very nice! 2 minutes & vlans are set

  • sathishenet Feb 10, 2009 @ 6:49

    Hi All,

    Very very basic question, for configuring VLAN in Linux is that necessary to have a manageable switches ??


  • Manisha Apr 20, 2009 @ 12:20

    Can you give me the whole codes for virtual lan. and there should be browser and it should allow us to access a file from another ip address and it should allow copy, paste, save, open commands in that programm for that access file.

  • Shlomi May 25, 2009 @ 12:31

    The line “DEVICE=ifcfg-eth0.5”, should be written as “DEVICE=eth0.5” !!!

  • Arun Menon Nov 26, 2009 @ 10:48

    hey folks
    how can i configure the vlan priority bits on the ethernet header…it wud be of gr8 help if ne1 could provide som inputs on this


  • Venkat Jan 17, 2010 @ 2:44

    In the above test I have seen the statement like “Remove gateway entry from all other network config files.” How can I find the places where the gateway is configured on the system ?

    Please let me know how can I test my vlan config using one single Linux PC ?

  • sayantan Feb 7, 2010 @ 8:18

    is it virtual ip?can it be used with RAC?

  • hafeez Mar 18, 2010 @ 7:29

    A working configuration example from

    Server ip :
    Swtich ip / gateway ip of server :
    Option domain –name servers :

    Please note default vlan 172.27.0.x in this case

    Switch and server need to be in default lan for communication / or else we need to trunk in case other vlan connected , we need to configure vconfig on server to communicate

    For biggner I would recommend to go for the default vlan connectivity

    Example :

    ddns-update-style interim;
    ignore client-updates;
    default-lease-time 43200;
    max-lease-time 43200;
    #-----subnet mask-- broadcast-- gateway-#
    option subnet-mask;
    #option broadcast-address;
    option routers;
    option domain-name-servers;
    # ----------- Server Scope and vlan1 with switches and server--------------#
    subnet netmask {
    option routers;
    #option subnet-mask;
    option broadcast-address;
    #option domain-name-servers;
    # ----------- clients1 Scope-vlan2-------------#
    subnet netmask {
    option routers;
    option subnet-mask;
    option broadcast-address;
    #option domain-name-servers #
    Save the file
    Chkconfig –list dhcpd on

    { For enabling the service on all run levels }
    Service dhcpd start
    In case , dhcp server faild to start , check with log messages


    Check for the ip helper address in layer 3 swtich , which act as dhcp-relay
    Which has to be configured as

    Troubleshooting Dhcp server start up error :

    1) Run the Dhcp service in debug mode
    2) Check the ip configuration
    3) Check for syntax errors in dhcpd.conf file
    4) Check for the right location of the dhcpd file
    5) Ping test between the switch and server
    6) Possible conflict of other dhcp server may be the issue

    dhcpd in the foreground in debug mode with /usr/sbin/dhcpd -d –f

    Hopefully, a DHCP server like the one we’ll be configuring will respond. Running tcpdump shows a dhcp request looks like:
    17:26:02.003956 00:00:00:00:00:00 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0×0800), length 342: > BOOTP/DHCP, Request, length 300
    You should notice DHCP running in the process (ps) list. Any problems, check syslog

    Congratulations you have finally configured In easy steps

  • kashyap Apr 6, 2010 @ 7:14

    I have just installed rh5 in a Xen server. I have attached a vlan to the virtual rh5 server.
    The problem is I am unable to view any interface. I see only loop back device.
    I have even tried modprobe 8021q but still no success.
    I am using 2.6.18-92.el5xen kernal.
    Any help would be great

  • Redman Apr 21, 2010 @ 9:49

    hi all

    we are on a VLAN Network my issue is on the dhcpd.conf side coz wana configure My opensuse 11 box to serve ip’s (DHCP Server) on diffrent VLAN , Wana Replace our Windows DHCP Server for some Technical Reasons , my susebux has only one phsysical Network interface , is this possible to serve all VLAN? iphelper is already confgured on our L3 Switches , actually OUr Windows DHCP Server is already runnning and serving this vlans , but i just wana replace it with linux

    is this a dhcpd issue to vconfig?

    heres is our VLAN Scheme


    VLAN # xx
    Range :

    VLAN # xx
    Range : – xxx

    VLAN # xx
    Range :

    VLAN #xx
    Range :

    Dept. 5
    VLAN # xx

  • Bo Svensson May 8, 2010 @ 11:37

    Hi all!
    I want to set up a functionality rich, cost efficient, energy efficient, network like this:
    – A Linux box (e.g. based on a Mini-ITX with one NIC),
    connected to a managed switch (with VLAN support, like DES-3010GA).
    The link between Linux box and switch will be only tagged (all VLAN:s).
    On the switch I want untagged VLAN:s, like “internet”, “DMZ” and “LAN”.

    My question: Can the Linux box be both VLAN manager and router (replace
    a Level 3 switch) and firewall or do I need a second Linux with three NICs?

    If it can be done with one Linux box and a switch, the I can get the whole
    package (DMZ firewall, VLAN-support, VPN, etc) for some $600. The total
    power consumption would be around 40 watt (Linux+switch). As green as
    it gets 🙂

    Have anyone done anything similar?

    Regards, Bo Svensson

  • audio rodriguez Oct 2, 2010 @ 20:56

    how i do vlan with vconfig in windows ?

  • Thomas Oct 22, 2010 @ 12:17

    With your HowTo:

    # vconfig add eth0 5
    # ifconfig vlan5

    # vconfig add eth0 5
    # ifconfig vlan5

    If both boxes are connected to the same network, I’d assume pinging from one to the other shall work:
    # ping
    PING ( 56(84) bytes of data.
    64 bytes from icmp_req=1 ttl=64 time=0.037 ms
    64 bytes from icmp_req=2 ttl=64 time=0.021 ms

    # ping
    PING ( 56(84) bytes of data.
    From icmp_seq=1 Destination Host Unreachable
    From icmp_seq=2 Destination Host Unreachable
    From icmp_seq=3 Destination Host Unreachable

    Routing is set up OK on both boxes:
    # route
    Ziel Router Genmask Flags Metric Ref Use Iface * U 0 0 0 vlan5

    # route
    Ziel Router Genmask Flags Metric Ref Use Iface * U 0 0 0 vlan5

    Since there is nothing than a little, unmanageable switch in between these two hosts …

  • venky Feb 24, 2011 @ 6:39

    Regarding Ethernet switch,
    If I have to configure two VLANs with VID = 3700 and 3800, what value do I put in field FID, since it is only 7 bit and cannot contain the above mentioned VIDs

  • Vaerer Jul 1, 2011 @ 9:42

    “My VLAN ID is 5. So I need to copy file /etc/sysconfig/network-scripts/ifcfg-eth0 to /etc/sysconfig/network-scripts/ifcfg-eth0.5”

    What is a VLAN ID? How do you know what your VLAN ID is?

  • grace owiny Jul 13, 2011 @ 7:09

    hey please send me the commands for configuring vlan on cisco switches. i am using packet tracer a software for this.thanx

  • Garvit Feb 10, 2012 @ 19:24

    Very helpful information.
    Working fine 🙂

  • Bipin Apr 22, 2012 @ 9:45

    You need to add the following line inside the VLAN interface.


    Otherwise the physical switch cannot understand the VLAN through its handshake.

  • yikee Apr 27, 2012 @ 2:51

    Hi, If i would like to create few VLAN in 1 PC with different ID and let others PC connect to it?? It is possible?? How others PC connect to the VLAN that i created??

  • yikee Apr 27, 2012 @ 3:29

    Hi, How i detect whether others Pc already connected to the VLAN that i had created??

  • anil May 30, 2012 @ 11:25

    Hi all
    please send me steps about “Nagios Quick-start” configuration on fedora OS …


  • John Nelson Oct 4, 2012 @ 16:18

    Instructions for setting up, under CentOS, a virtual interface that will tag it’s packets for VLAN(x) work as advertised.. Thanks for sharing.

  • Ben Watson Jun 10, 2013 @ 8:20

    A fantastic tutorial. The vconfig utility works perfectly for me – thank you very much.

  • anonymous IT person Jul 8, 2013 @ 15:10

    This all sounds pretty good so far. I use the dhcpd.conf file on Centos to assign static IP addresses to the different devices.. Will I be able to do the same thing on a VLAN setup? Will I be able to assign the vlan IP addresses to their respective devices?

  • Manoz Karmacharya Feb 17, 2014 @ 16:49

    I used vconfig to add VlAN to CentOS 6.5. But in every reboot, all the vlan configuration gets erased.

  • Joe Dakine Feb 26, 2014 @ 23:54

    You have an error in your ifcfg-eth0.5 config file:
    What you have: DEVICE=ifcfg-eth0.5
    What is should be: DEVICE=eth0.5

    • NIX Craft Feb 27, 2014 @ 8:56

      Thanks for the heads up. The blog post has been updated.

  • Artimis Nov 17, 2014 @ 4:57

    Thanks for your post.
    The method #2 is temporary and it’s like adding route because after restarting the server, it will be deleted and must be added again. right?

  • sachin Nov 24, 2014 @ 1:00

    Can this be used if i want to plumb different segment IP’s as virtual IP addresses under same single NIC. If not, suggest how the communication can be achieved between these?

    For e.g
    eth0 192.X.X.108/27
    eth0:0 192.X.X.110/27
    eth0:1 10.X.X.X/24
    eth0:2 10.X.X.X/24

  • vijay Jan 9, 2017 @ 17:32

    Hi nixCraft, I am facing vlan config problem. Please help me!!!

    Here is my set-up:
    -> Installed OS (rhel7) on my hp server
    -> Hp server contain 4 Physical NIC cards. (eno1, eno2, eno3 & eno4)
    -> I bonded eno2 & eno3 and created bond0
    -> Now I created vlans from bond0 (bond0.100, bond0.200 & bond0.300)
    -> I renamed these vlan’s to bond0.100 -> eth0 / bond0.200 -> eth1 & bond0.300 -> eth2
    -> I assigned series to eth0 vlan / series to eth1 vlan
    -> Now I created bridges (eth0br, eth1br & eth3br)
    -> Now I mapped each one (eth0 -> eth0br / eth1-> eth1br / eth2 -> eth2br)
    -> Now I created VM
    -> I got eth0, eth1 and eth2 on the VM side
    -> I assigned eth0 to and for eth1 to
    -> But when I ping from, I’m getting Host Unreachable error

    Please let me know what I’m doing wrong here


  • Dongju Ko Feb 22, 2017 @ 1:22

    Hello. I am a student who studies Ethernet communication.
    I have a question about VLAN support.
    Even if a device does not have Ethernet switch which support 802.1Q, is it possible to implement VLAN by using Linux?

    Thank you.

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum