I have a Proxmox host with kernel 5.15.19-2-pve.
It has a bond0 interface made from eth2 and eth3, which receives vlan tagged traffic.
I created a vmbr666 bridge that shows looks like this:
# /etc/network/interfaces:
auto vmbr666
iface vmbr666 inet manual
bridge-ports bond0
bridge-stp off
bridge-fd 0
bridge-vlan-aware yes
bridge-vids 2-4094
mtu 9220
# brctl show
vmbr666 8000.5a0a13a9dd29 no bond0
tap151034i1
# ip -d link sh dev vmbr666
66: vmbr666: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9220 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 5a:0a:13:a9:dd:29 brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
bridge forward_delay 0 hello_time 200 max_age 2000 ageing_time 30000 stp_state 0 priority 32768 vlan_filtering 1 vlan_protocol 802.1Q bridge_id 8000.5a:a:13:a9:dd:29 designated_root 8000.5a:a:13:a9:dd:29 root_port 0 root_path_cost 0 topology_change 0 topology_change_detected 0 hello_timer 0.00 tcn_timer 0.00 topology_change_timer 0.00 gc_timer 251.81 vlan_default_pvid 1 vlan_stats_enabled 0 vlan_stats_per_port 0 group_fwd_mask 0 group_address 01:80:c2:00:00:00 mcast_snooping 1 mcast_router 1 mcast_query_use_ifaddr 0 mcast_querier 0 mcast_hash_elasticity 16 mcast_hash_max 4096 mcast_last_member_count 2 mcast_startup_query_count 2 mcast_last_member_interval 100 mcast_membership_interval 26000 mcast_querier_interval 25500 mcast_query_interval 12500 mcast_query_response_interval 1000 mcast_startup_query_interval 3124 mcast_stats_enabled 0 mcast_igmp_version 2 mcast_mld_version 1 nf_call_iptables 0 nf_call_ip6tables 0 nf_call_arptables 0 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
Note that vlan_filtering
is 1
.
If I tcpdump -enlvvv
on bond0, I see traffic for VLAN42. If I tcpdump on vmbr666
or tap151034i1
, I don't see traffic for VLAN42 (not even broadcasts or multicasts, even though I do see broadcast traffic of some other VLANs). Question: why not?
Relevant output from bridge -c vlan show
:
bond0 1 PVID Egress Untagged
2-99
tap151034i1 1 PVID Egress Untagged
2-99
vmbr666 1 PVID Egress Untagged
Like I said, I do see traffic for other VLANs on all of these interfaces, including tags, e.g.
15:03:35.293420 00:50:56:b1:24:0c > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 49, p 0, ethertype ARP (0x0806), Ethernet (len 6), IPv4 (len 4), Request who-has 10.76.155.200 tell 10.76.155.51, length 46
Now let's add vlan 42 to the vmbr666
interface to see if it makes any difference:
# bridge vlan add vid 42 dev vmbr666 self
# bridge -c vlan show dev vmbr666
port vlan-id
vmbr666 1 PVID Egress Untagged
42
In tcpdump -enlvvv -i vmbr666
I still don't see anything related to vlan42, just other VLANs (e.g. 49 and 50).
Let's create a subinterface for vlan42 on tap151034i1
like this:
ip link add link tap151034i1 name test type vlan protocol 802.1q id 42 reorder_hdr on gvrp on mvrp on loose_binding off; ip link set up dev test
Running tcpdump -enlvvv -i test
I see no traffic at all.
There is a vmbr42
, which may interfere (but if so, why does it interfere?):
vmbr42 8000.9a0f54fe1040 no bond0.42
fwpr103p0
fwpr104p0
fwpr105p0
fwpr151034p0
tap102i0
In ip -d link sh
:
31: vmbr42: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 9a:0f:54:fe:10:40 brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
bridge forward_delay 0 hello_time 200 max_age 2000 ageing_time 30000 stp_state 0 priority 32768 vlan_filtering 0 vlan_protocol 802.1Q bridge_id 8000.9a:f:54:fe:10:40 designated_root 8000.9a:f:54:fe:10:40 root_port 0 root_path_cost 0 topology_change 0 topology_change_detected 0 hello_timer 0.00 tcn_timer 0.00 topology_change_timer 0.00 gc_timer 53.08 vlan_default_pvid 1 vlan_stats_enabled 0 vlan_stats_per_port 0 group_fwd_mask 0 group_address 01:80:c2:00:00:00 mcast_snooping 1 mcast_router 1 mcast_query_use_ifaddr 0 mcast_querier 0 mcast_hash_elasticity 16 mcast_hash_max 4096 mcast_last_member_count 2 mcast_startup_query_count 2 mcast_last_member_interval 100 mcast_membership_interval 26000 mcast_querier_interval 25500 mcast_query_interval 12500 mcast_query_response_interval 1000 mcast_startup_query_interval 3124 mcast_stats_enabled 0 mcast_igmp_version 2 mcast_mld_version 1 nf_call_iptables 0 nf_call_ip6tables 0 nf_call_arptables 0 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
Note that vlan_filtering
is 0
.
Running tcpump -enlvvv
on vmbr42
or tap102i0
, which is one of its members, shows VLAN42 traffic, without tags -- no surprises there.
There are no ebtables
or arptables
rules.
I guess I don't understand the interplay between VLAN memberships and bridge interfaces in Linux.
Some theoretical questions:
- What is the effect of adding a VLAN to a bridge master interface with the
self
keyword inbridge vlan add
? - What is the effect of creating a VLAN subinterface of a bridge member interface?
- If a physical interface has a VLAN subinterface, and that's added to a bridge, are any frames for that VLAN supposed to be visible on other bridges the same physical interface is a member of? If not, why not?
- What is the difference, from a theoretical as well as practical perspective, between, on the one hand, creating VLAN subinterfaces of physical interfaces and bridging those, and on the other hand, enabling
vlan_filtering
on a bridge and usingbridge vlan pvid untagged
to give place some member interfaces in specific VLANs? - Can you mix these two approaches?
EDIT: removed stuff that was shown in comments to be irrelevant, and added theoretical questions to hopefully help better structure the answer.