Has anyone tried private vlan's under Linux? Any experiences with them? My real question is does anybody have howtos regarding this?
I don't know if Linux supports Cisco's concept of "private VLANs" per se, but what private VLANs essentially are is a link-layer firewall controlling which switch ports can talk to which other switch ports. So if you've got a Linux box with several Ethernet devices and are bridging between them (e.g. with the
brctl tool), I think the tool you want is called
ebtables. If you're familiar with
shouldn't be too hard to pick up from the man page.
Note, though, that describing all of the private VLAN concepts at once using
ebtables might be complicated. And if you want to share PVLAN groupings with a Cisco switch (assuming that's possible), I'm guessing this isn't the way to go about it.
This may help... Is it possible to enable port isolation on linux bridges https://serverfault.com/questions/388544/is-it-possible-to-enable-port-isolation-on-linux-bridges
If you are talking about a computer with multiple Ethernet ports and wanting all the ports to be 'in the same LAN' but set so they are protected and can't talk to each other, I only have a solution using BSD.
In FreeBSD, create a bridge and add ports to a bridge like this:
ifconfig bridge0 create ifconfig bridge0 addm em0 addm em1 addm em2
Now you have a 'switch' with 6 ports. They can all see each other. To isolate ports em1 and em2 from each other (similar to PVLAN or 'switchport protected') you would run:
ifconfig bridge0 private em1 private em2 private
You can add an ip to the bridge as well...
ifconfig bridge0 10.12.14.1/24
Both ports would still see traffic from em0. If you wanted to isolate em0 as well:
ifconfig bridge0 private em0
More on this here: http://www.freebsd.org/doc/handbook/network-bridging.html#idp97030960
[yes, the initial question was a few years ago... I am looking for a Linux solution as well, but thought I'd share this BSD solution]
I don't know what you mean by "private" VLAN's, but Linux does VLANs. The
ip command from iproute2 can configure them. You do have to have a NIC and driver that supports it, but most do these days.
I'm sure there's a million ways to do it, but I've used 'vconfig' to add vlans in the past.
First add the vlan
'vconfig add eth0 123'
Now you can configure the sub interface
'ifconfig eth0.123 ...'