Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm learing vlan concept and came around private vlan rfc. I think that i understand the reason and implication of isolated domain, but i'm not sure that i understand the community domain. Particularly i don't understand the difference between regular vlan and private vlan (community domain).
I'm not a system administrator, but for correct implementation it is important for me to understand how it used in real network.
Thanks for any input, Ilya.

P.S the question is very simalary to this one, but a bit more theoretical although i will be glad to see practical example how to configure isolated vlan on linux.

share|improve this question
up vote 1 down vote accepted

Here is short description of different port configuration in Private VLANs - http://www.cisco.com/en/US/tech/tk389/tk814/tk840/tsd_technology_support_sub-protocol_home.html

Are you going to implement PVLANs in PC (Linux)? Or just configure it on the switch? If on PC, you would have to use separate physical interfaces, bridge them and use ebtables to block the traffic on L2 as mentioned in the post you have linked.

I will try to explain what Private VLAN is... Normal VLAN is like separate physical network, but it is done just logically on the switch. Computers within the same VLAN can communicate with each other, they are in the same broadcast domain.

For many reasons (mainly security and eliminating broadcasts), you can create a "Private VLAN", which causes that computers no longer see each other, they can only see its gateway. If you want to communicate with other computer in Private VLAN, you can do that only on L3 - route packets through a router.

Now the different port configurations explained (I use names from that Cisco link):

  • Isolated: normal computers, they cannot see anyone, just gateway (promiscuous)

  • Community: For example server cluster nodes, they can see each other + gateway, but not other computers, which are Isolated

  • Promiscuous: gateway, all others can see it

For client workstations you would just defined them as Isolated and gateway as Promiscuous. For servers, gateway is Promiscuous, but would define multiple Communities for servers which have to communicate within themselves or for clusters.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.