How do you make a Linux bridge VLAN aware, with trunk and access ports?
Show the answer
Say this first
Create the bridge with vlan_filtering 1, then set VLAN membership per port with bridge vlan. A port with
several tagged VLANs is a trunk. A port with one VLAN marked pvid untagged is an access port: untagged
frames coming in join that VLAN, and frames going out lose their tag. Every port starts in VLAN 1 as PVID
untagged, so remove it where you do not want it. One VLAN-aware bridge replaces the old pattern of one
bridge per VLAN.
Go deeper
Config
ip link add br0 type bridge vlan_filtering 1
ip link set ens224 master br0 # trunk to the switch
ip link set vnet0 master br0 # VM in VLAN 10
ip link set vnet1 master br0 # VM in VLAN 20
bridge vlan add dev ens224 vid 10
bridge vlan add dev ens224 vid 20
bridge vlan del dev vnet0 vid 1
bridge vlan add dev vnet0 vid 10 pvid untagged
bridge vlan del dev vnet1 vid 1
bridge vlan add dev vnet1 vid 20 pvid untaggedResult
$ bridge vlan show
port vlan-id
ens224 1 PVID Egress Untagged
10
20
br0 1 PVID Egress Untagged
vnet0 10 PVID Egress Untagged
vnet1 20 PVID Egress Untaggedens224is a trunk: VLAN 1 untagged (the native VLAN, which must match the switch) plus 10 and 20 tagged.vnet0andvnet1are access ports in 10 and 20.br0is the host's own port. To give the host an address in VLAN 10:bridge vlan add dev br0 vid 10 selfandip link add link br0 name br0.10 type vlan id 10.
The Cisco mapping
PVID is the access VLAN or native VLAN. "Egress Untagged" is the VLAN that leaves without a tag. A VLAN listed without flags is tagged, as on an 802.1Q trunk.
They will ask next
How do you stop new ports from joining VLAN 1 automatically?
ip link set br0 type bridge default_pvid 0. New ports then join no VLAN until you add one.How would you do this without VLAN filtering?
One bridge per VLAN:
ens224.10inbr10with the VLAN 10 VMs,ens224.20inbr20. It works but means many bridges and VLAN interfaces, so the VLAN-aware bridge is the better design today.
Traps
- Forgetting VLAN 1 stays on every port as PVID untagged unless you remove it.
- Adding VLANs to the ports but not to
br0 self, then wondering why the host cannot reach a VLAN.