<< Back to article

VLAN

A Virtual Local Area Network (VLAN) is a method of creating independent logical networks within a single physical network infrastructure. VLANs allow network administrators to segment traffic, improve security, and reduce broadcast domains without rewiring.

IEEE 802.1Q

The IEEE 802.1Q standard defines VLAN tagging. Each Ethernet frame is tagged with a 12-bit VLAN ID (VID), allowing up to 4094 VLANs (0 and 4095 are reserved).

How VLANs Work

  • Access ports: Carry traffic for a single VLAN (untagged frames).
  • Trunk ports: Carry traffic for multiple VLANs (tagged frames).
  • Tagging: When a frame enters a trunk port, the switch adds a VLAN tag. When it leaves an access port, the tag is removed.

Linux VLAN Configuration

Create a VLAN interface on Linux:

ip link add link eth0 name eth0.10 type vlan id 10
ip addr add 192.168.10.10/24 dev eth0.10
ip link set eth0.10 up

Persistent configuration via systemd-networkd:

# /etc/systemd/network/25-vlan.netdev
[NetDev]
Name=eth0.10
Kind=vlan

[VLAN]
Id=10

# /etc/systemd/network/25-vlan10.network
[Match]
Name=eth0.10

[Network]
Address=192.168.10.10/24
Gateway=192.168.10.1

802.1Q Trunking

To receive tagged frames from a trunk port, create a trunk interface:

ip link add link eth0 name eth0.100 type vlan id 100
ip link set eth0.100 up

Multiple VLANs on one physical interface:

ip link add link eth0 name eth0.10 type vlan id 10
ip link add link eth0 name eth0.20 type vlan id 20
ip link add link eth0 name eth0.30 type vlan id 30

QinQ (802.1ad)

QinQ (stacked VLANs) adds an outer VLAN tag to an already-tagged frame, enabling service providers to carry customer VLANs transparently.

ip link add link eth0 name eth0.100 type vlan proto 802.1ad id 100
ip link add link eth0.100 name eth0.200 type vlan id 200

Bridge with VLANs

VLANs work with bridges for virtualised environments:

ip link add name br0 type bridge
ip link set eth0.10 master br0
ip link set eth0.20 master br0
ip link set br0 up

Benefits

  • Security: Isolate sensitive traffic (e.g., voice, management, guest).
  • Broadcast control: Limit broadcast domains.
  • Flexibility: Group users by function rather than physical location.
  • Simpler management: Changes are logical, not physical.