Bridging untagged and tagged VLANs
Hello everybody,
I got a weird problem but don't know if it is expected to work.
brctl addbr br0
vconfig add eth0 30
brctl addif br0 eth0.30
Until here, everythink works well... I can access the VLAN with id 30. But when I run the following:
brctl addif br0 eth0
Then, I can't access the VLAN any more but the untagged LAN. But instead of adding eth0:
vconfig add eth0 40
brctl addif br0 eth0.40
It works.
It would be nice if you can me give a short advice... Is it not possible to bridge an untagged LAN with a tagged VLAN or is this a bug?
Sincerely,
Michael
Kernel 2.6.29, brctl 1.4
Quoted 11 lines · Michael Tremer
Hello everybody,
I got a weird problem but don't know if it is expected to work.brctl addbr br0
vconfig add eth0 30
brctl addif br0 eth0.30Until here, everythink works well... I can access the VLAN with id 30. But when I run the following:
brctl addif br0 eth0
I'm sure someone will step in and correct me if I'm wrong.
You are wanting to treat packets with no VLAN header the same as those tagged in VLAN 30. But "eth0" does not mean "packets with no VLAN header", it means *ALL* packets which arrive through eth0. This packet stream is passed through VLAN processing and distribution is done, dealing the payloads (now without the VLAN header) to the virtual interfaces.
Imagine if the bridge module blindly did what you asked. Then every packet in eth0.30 would have a VLAN header added and placed into eth0 for transmission. Because eth0 is part of a bridge, it is eligible for transmission through each port of the bridge, so it is copied to eth0.30. Now the VLAN module processes it out, adding a VLAN header and placing it into eth0. The snowball effect would quickly swamp the network. So bridge ignores the virtual slave interfaces if you brctl addif the master device.
I don't think Linux VLAN support provides a way to separate packets with _no_ VLAN header onto a virtual interface, but that surely sounds useful. There'd be problems with nested VLANs though. In a system with two layer nesting, is a packet that arrives with only one tag treated as missing the inner tag or the outer one?
Quoted 24 lines
Then, I can't access the VLAN any more but the untagged LAN. But instead of adding eth0:
vconfig add eth0 40
brctl addif br0 eth0.40It works.
It would be nice if you can me give a short advice... Is it not possible to bridge an untagged LAN with a tagged VLAN or is this a bug?
Sincerely,
Michael
Kernel 2.6.29, brctl 1.4
_______________________________________________
Bridge mailing list
[email protected]
https://lists.linux-foundation.org/mailman/listinfo/bridge
Quoted 3 lines · "[email protected]" <[email protected]> writes:
I don't think Linux VLAN support provides a way to separate packets with _no_ VLAN header onto a virtual interface, but that surely sounds useful.
It would be handy if VLAN 0 meant "packets tagged with VLAN 0 + packets without tags". The VLAN 0 tag is reserved for packets in the native VLAN which need 802.1p priority.
Then you could bridge eth0.0 and eth0.30 for the desired effect.
/Benny
Oh, and:
Quoted 3 lines · "[email protected]" <[email protected]> writes:
There'd be problems with nested VLANs though. In a system with two layer nesting, is a packet that arrives with only one tag treated as missing the inner tag or the outer one?
Inner tag missing. So eth0.0.30 would not ever receive any traffic (or be able to send it in a RFC-conformant way), whereas eth0.30.0 would be fine.
/Benny
To do this seamlessly you need a VLAN aware bridge - the kernel has separate support for VLAN and bridging, but not integrated. I posted a patch a while back to fix this - see here:
http://www.mail-archive.com/[email protected]/msg01440.html
It was for a 2.4 kernel, but shouldn't take too much work to port to 2.6.
Simon
Quoted 35 lines · Michael Tremer
Hello everybody,
I got a weird problem but don't know if it is expected to work.brctl addbr br0
vconfig add eth0 30
brctl addif br0 eth0.30Until here, everythink works well... I can access the VLAN with id 30. But when I run the following:
brctl addif br0 eth0
Then, I can't access the VLAN any more but the untagged LAN. But instead of adding eth0:
vconfig add eth0 40
brctl addif br0 eth0.40It works.
It would be nice if you can me give a short advice... Is it not possible to bridge an untagged LAN with a tagged VLAN or is this a bug?
Sincerely,
Michael
Kernel 2.6.29, brctl 1.4
_______________________________________________
Bridge mailing list
[email protected]
https://lists.linux-foundation.org/mailman/listinfo/bridge
Thanks for your answers.
In this mail on
http://www.mail-archive.com/[email protected]/msg01440.html
there is the following sentence: "- Add native support for an untagged vlan. Currently an untagged
vlan can be implimented using ebtables or similar."
Do you know how to do this? Seems to be the easiest way for me, because I don't
think that I would be able to port this patch to 2.6. (But may be there is somebody who
would like to do this. I want to put all these things into a linux firewall www.ipfire.org, though there
is an efford for the open source community.)
Have you ever submitted this patch to the kernel developers?
Michael
Quoted 48 lines · Simon Barber
To do this seamlessly you need a VLAN aware bridge - the kernel has separate support for VLAN and bridging, but not integrated. I posted a patch a while back to fix this - see here:
http://www.mail-archive.com/[email protected]/msg01440.html
It was for a 2.4 kernel, but shouldn't take too much work to port to 2.6.
Simon
Quoted 35 lines · Michael Tremer
Hello everybody,
I got a weird problem but don't know if it is expected to work.brctl addbr br0
vconfig add eth0 30
brctl addif br0 eth0.30Until here, everythink works well... I can access the VLAN with id 30. But when I run the following:
brctl addif br0 eth0
Then, I can't access the VLAN any more but the untagged LAN. But instead of adding eth0:
vconfig add eth0 40
brctl addif br0 eth0.40It works.
It would be nice if you can me give a short advice... Is it not possible to bridge an untagged LAN with a tagged VLAN or is this a bug?
Sincerely,
Michael
Kernel 2.6.29, brctl 1.4
_______________________________________________
Bridge mailing list
[email protected]
https://lists.linux-foundation.org/mailman/listinfo/bridge
Quoted 8 lines · Michael Tremer
In this mail on
http://www.mail-archive.com/[email protected]/msg01440.html
there is the following sentence: "- Add native support for an untagged vlan. Currently an untagged vlan can be implimented using ebtables or similar."Do you know how to do this?
For as far as I remember, the right way to do it with ebtables is :
brctl addbr br0
vconfig add eth0 30
brctl addif br0 eth0.30
brctl addif br0 eth0
ebtables --table broute -A BROUTING --protocol 802_1Q --vlan-id 30 --jump DROP
Normally, a DROP target in BROUTING let the frame being ROUTED. The exact behavior is "give it to upper layer", which is IP in most case. But, for a 802.1q tagged frame, the upper layer is "remove the 802.1q header and give it again to lower layer, on the right interface".
So this ebtables entry deny the bridge the opportunity to eat frames having a 802.1q vlan id = 30, giving the opportunity to the vlan stack to remove the vlan header and give it to eth0.30...
Not tested, because I don't have a bridge available right now, but this should work.
Of course, if you add several eth0.X interfaces to the bridge, you should add the corresponding ebtables entry. For very special configuration, --in-interface eth0 might be necessary too.
Just thinking about it, the --vlan-id 30 might be useless. Juste having --protocol 802_1Q might be enough for simple configuration. Just try and told us.
HTH.
Nicolas.
Oops, just sent the email when your one scrabbled to my inbox.
https://lists.linux-foundation.org/pipermail/bridge/2009-July/006626.html
I applied that ebtables rule to the chain but no packages got to the vlan interface (eth0.30) anymore.
Michael
Quoted 33 lines · Nicolas de Pesloüan
Quoted 8 lines · Michael Tremer
In this mail on
http://www.mail-archive.com/[email protected]/msg01440.html
there is the following sentence: "- Add native support for an untagged vlan. Currently an untagged vlan can be implimented using ebtables or similar."Do you know how to do this?
For as far as I remember, the right way to do it with ebtables is :
brctl addbr br0
vconfig add eth0 30
brctl addif br0 eth0.30
brctl addif br0 eth0ebtables --table broute -A BROUTING --protocol 802_1Q --vlan-id 30 --jump DROP
Normally, a DROP target in BROUTING let the frame being ROUTED. The exact behavior is "give it to upper layer", which is IP in most case. But, for a 802.1q tagged frame, the upper layer is "remove the 802.1q header and give it again to lower layer, on the right interface".
So this ebtables entry deny the bridge the opportunity to eat frames having a 802.1q vlan id = 30, giving the opportunity to the vlan stack to remove the vlan header and give it to eth0.30...
Not tested, because I don't have a bridge available right now, but this should work.
Of course, if you add several eth0.X interfaces to the bridge, you should add the corresponding ebtables entry. For very special configuration, --in-interface eth0 might be necessary too.
Just thinking about it, the --vlan-id 30 might be useless. Juste having --protocol 802_1Q might be enough for simple configuration. Just try and told us.
HTH.
Nicolas.
Quoted 7 lines · Michael Tremer
Oops, just sent the email when your one scrabbled to my inbox.
https://lists.linux-foundation.org/pipermail/bridge/2009-July/006626.html
I applied that ebtables rule to the chain but no packages got to the vlan interface (eth0.30) anymore.
Michael
For as far as I remember, this hack works really well when eth0 and eth0.30 are not in the same bridge (br0/br1). Anyway, I cannot think of a good reason for it not to work in a single bridge.
Try and dig around with ebtable, using the logging feature. Im' pretty sure it works, but does not have a bridge available here to test.
I googled around to try and find the original web page where a learned this hack, but without any success. You can try, searching for ebtables+BROUTING+DROP+802_1Q+vlan-id and so on...
Nicolas.
Quoted 11 lines · Nicolas de Pesloüan
Quoted 8 lines · Michael Tremer
Oops, just sent the email when your one scrabbled to my inbox.
https://lists.linux-foundation.org/pipermail/bridge/2009-July/006626.html
I applied that ebtables rule to the chain but no packages got to the vlan interface (eth0.30) anymore.
Michael
For as far as I remember, this hack works really well when eth0 and eth0.30 are not in the same bridge (br0/br1). Anyway, I cannot think of a good reason for it not to work in a single bridge.
Well, it actually does not. But there is a very interesting thing: The eth0.30 gets all packages (esp. ARP and my ICMP reply for testing) but the ping command on the other shell returns *nothing*. iptables has no rules got and policy is ACCEPT.
brctl addbr br0
brctl addbr br1
brctl addif br0 eth0
brctl addif br1 eth0.30
ebtables -t broute -D BROUTING -p 802_1Q -i eth0 -j DROP is the command.
Do you have got any ideas how to debug this?
Quoted 6 lines
Try and dig around with ebtable, using the logging feature. Im' pretty sure it works, but does not have a bridge available here to test.
I googled around to try and find the original web page where a learned this hack, but without any success. You can try, searching for ebtables+BROUTING+DROP+802_1Q+vlan-id and so on...
Nicolas.
Sincerely,
Michael
Well, I think the kernel patch is the easier way, but ebtables is more easy.
So I tried with the following command:
ebtables -t broute -A BROUTING -p 802_1Q -i eth0 -j DROP
Then, the VLAN 30 and the untagged (V)LAN can be bridged (Well I tried it with arping -I br0 192.168.181.1 and got a MAC from the machine 192.168.181.1 on VLAN 30).
But I still cannot do the following:
brctl addbr br0
brctl addif br0 eth0
brctl addbr br1
brctl addif br1 eth0.30
br0 works.
br1 doesn't work. Not even ARP.
ebtables rule was set.
Any ideas?!
Thanks for the great help up to now.
Michael
Quoted 46 lines · Simon Barber
To do this seamlessly you need a VLAN aware bridge - the kernel has separate support for VLAN and bridging, but not integrated. I posted a patch a while back to fix this - see here:
http://www.mail-archive.com/[email protected]/msg01440.html
It was for a 2.4 kernel, but shouldn't take too much work to port to 2.6.
Simon
Quoted 35 lines · Michael Tremer
Hello everybody,
I got a weird problem but don't know if it is expected to work.brctl addbr br0
vconfig add eth0 30
brctl addif br0 eth0.30Until here, everythink works well... I can access the VLAN with id 30. But when I run the following:
brctl addif br0 eth0
Then, I can't access the VLAN any more but the untagged LAN. But instead of adding eth0:
vconfig add eth0 40
brctl addif br0 eth0.40It works.
It would be nice if you can me give a short advice... Is it not possible to bridge an untagged LAN with a tagged VLAN or is this a bug?
Sincerely,
Michael
Kernel 2.6.29, brctl 1.4
_______________________________________________
Bridge mailing list
[email protected]
https://lists.linux-foundation.org/mailman/listinfo/bridge