I’m in the process of rebuilding my home network, splitting the network into separate VLANs. My Ubuntu server is connected to a trunk port on my switch, and I need to create virtual interfaces to allow it to access all of the VLANs I’ve set up. It turns out this is fairly straightforward.
First we install the
vlan and add the
8021q kernel module.
Next we can create the virtual interfaces, in my case they will share the
Since I’m using DHCP for everything I set up
/etc/network/interfaces as follows. You could alternatively set your virtual interfaces as
static and manually configure the IP, netmask, gateway etc.
We can now bring these interfaces up, and they should be reachable from their respective VLANs:
One issue I ran into was that I couldn’t access the virtual interfaces from other VLANs. For example a client on
VLAN10 could ping this server on it’s
VLAN10 address, but not on
VLAN20. To get around this we need to change the Reverse Path Filtering setting in
The 3 values that can be set for the key rp_filter are:
0: No source address validation is performed and any packet is forwarded to the destination network
1: Strict Mode as defined in RFC 3074. Each incoming packet to a router is tested against the routing table and if the interface that the packet is received on is not the best return path for the packet then the packet is dropped.
2: Loose mode as defines in RFC 3074 Loose Reverse Path. Each incoming packet is tested against the route table and the packet is dropped if the source address is not routable through any interface. The allows for asymmetric routing where the return path may not be the same as the source path
In my case I want incoming packets on the VLAN interfaces to be able to route to other VLANS, so we can set this to 2.
After restarting the networking service
sudo service networking restart the server is now reachable on all interfaces.