Does Linux virtual bridge(configured with for example ip or brctl) support VLAN's? For example configure access ports in different VLAN's and trunk ports with only certain VLAN's enabled. Only option in my kernel(3.2.0-4-686-pae) configuration file regarding VLAN's and bridge is CONFIG_BRIDGE_EBT_VLAN, but as I understand, this enables filtering of 802.1q VLAN fields for ebtables.


Not a problem, it's the way most openWRT systems connect the wlan and switch ports into the same LAN. Here's an example of the config on my openWRT system which has two wifi networks, one for private use and one for guests:

# brctl show
bridge name     bridge id               STP enabled     interfaces
br-vlan2        7fff.a0f3c15eb708       no              eth0.2
br-vlan3        7fff.a0f3c15eb708       no              eth0.3

Some extra explanation:

The typical openwrt hardware (above is on a TP-Link WDR4300) has a switch that handles all the physical ports; sometimes the physical WAN port is a separate eth interface on the SoC CPU. The switch is connected to the CPU with a trunk (packets on this connection are tagged with a VLAN tag). So eth0.2 is VLAN2 that is simply connected to 4 of the physical switch ports, stripped of the VLAN tag.

So you should see br-vlan2 simply as the "LAN network", the VLANs are used due to necessity as there is just one connection from CPU to the switch.

An ethernet bridge in Linux can have VLANs and physical interfaces as members. That's according to my expectations as a VLAN interface behaves just like a physical interface in Linux, having its own routing, firewalling etc. just like any physical interface. I expect you could also add different VLANs to the bridge, if you don't mind the insanity that follows :)

I haven't tried bridging a physical interface such as eth0 that is also carrying VLAN-tagged traffic though... I don't know whether those tagged packets will also be bridged.

  • I see. So one should think that bridge(for example br-vlan2, br-vlan3) is the VLAN and you associate either tagged or non-tagged interfaces with this VLAN? Tagged(for example eth0.123) ports will behave like trunk ports in Cisco terminology and non-tagged(for example eth0) ports will behave like access ports? – Martin Mar 24 '15 at 13:59
  • I've elaborated my answer to cover your comment. But basically: yes. – wurtel Mar 24 '15 at 15:31

A trick is to explicitly tell the bridge it's ok to pass vlan traffic with the vconfig command. the below will do it on the command line and will go away with a reboot. To make it happen on reboot see https://serverfault.com/questions/414115/linux-vlans-over-bridge

brctl addbr br0
brctl addif br0 eth0
vconfig add br0 100
ifconfig br0.100 netmask

the above ifconfig should work on eth0 also since br0 and eth0 are bridged.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.