1

I created VLAN-aware bridge with command and add relevant interfaces:

% ip link add br0 type bridge vlan_filtering 1
% ip link set dev eth0 master br0
...

(and repeat this for eth1, eth2, eth3)

Now, I want the bridge ports to handle frames with multiple tags, and have the frames stripped off tags and delivered on port br0 where I have a listening daemon:

% bridge vlan del dev eth0 vid 1
% bridge vlan add dev eth0 vid 2-4094
...

(and repeat this for eth1, eth2, eth3)

After all commands completed, bridge setup looks as follows:

% bridge -c vlan sh
port    vlan ids
br0      1 PVID Egress Untagged

eth3     2-4094

eth2     2-4094

eth1     2-4094

eth0     2-4094

br1      1 PVID Egress Untagged

Now when I send ping from host behind eth0 interface to br0 (having IP 192.168.1.1), I see with tcpdump that eth0 is indeed receiving tagged frame (in my case ID is 10), however br0 does not receive anything. What am I missing?

Improve this question

1 Answer 1

Reset to default
1

The bridge self interface, which is the part of the bridge participating in routing, must also be put in the adequate VLAN.

To configure the bridge interface rather than one of its port, the additional keyword self is needed. The routing stack (at layer 3) handles IPv4 or IPv6 packets, so expects to receive frames of such type, not tagged frames. Hence VLAN ID 10 must be untagged when leaving the bridge (so the routing stack receive traffic) and this must be the Port VLAN ID, so traffic from the routing stack to the bridge gets tagged back. Only one VLAN can be linked to the routing stack this way.

This gives:

bridge vlan del dev br0 vid 1 self
bridge vlan add dev br0 vid 10 untagged pvid self
Improve this answer
5
  • 1
    to be more precise: multiple VLANs could be added to br0 all untagged and this would be ok for something like receiving one-way logs over UDP, but a reply can only be done using one VLAN (the one set as PVID).
    – A.B
    Commented Apr 19, 2022 at 2:10
  • thanks for response. Why PVID 1 (default?) can't be used? So, a packet returning from the routing stack to the bridge can be only PVID-tagged? But what tag will be decided on frames egressing eth[0-3] as in example above?
    – Mark
    Commented Apr 19, 2022 at 2:47
  • 1
    The routing stack (layer 3) doesn't know about VLANs. it must receive untagged traffic and will emit untagged traffic (precisely on Ethernet-like interfaces ether types 0x800+0x806 for IPv4+ARP and 0x8DD for IPv6). If you want to query from VLAN 10 the reply must be to VLAN 10 to be useful: hence br0 must be in VLAN 10 rather than default VLAN 1. VLAN tag must be stripped outside of the bridge and put back in the bridge.
    – A.B
    Commented Apr 19, 2022 at 9:31
  • If you want the system with the bridge acting as router for each of the VLANs, then it must have an interface (I'm talking about interface participating in routing. bridge ports don't participate in routing anymore) for each of the VLANs, not a single interface. Or you could try and play with VLAN sub interfaces on top of br0. Like br0.1 and br0.10 but that's not in the question. If you have an other problem, that wasn't described in the question and you should make a new question with the problem to solve (to avoid xyproblem.info )
    – A.B
    Commented Apr 19, 2022 at 9:35
  • I have posted another follow-up question unix.stackexchange.com/questions/699579/…
    – Mark
    Commented Apr 19, 2022 at 14:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .