0

Following up my other question I'd like to clarify the following:

To configure the bridge interface rather than one of its port, the additional keyword self is needed. The routing stack (at layer 3) handles IPv4 or IPv6 packets, so expects to receive frames of such type, not tagged frames. Hence VLAN ID 10 must be untagged when leaving the bridge (so the routing stack receive traffic) and this must be the Port VLAN ID, so traffic from the routing stack to the bridge gets tagged back. Only one VLAN can be linked to the routing stack this way.

A trunk port carries multiple VLANs, however PVID for frames leaving the bridge via the trunk port (from the routing stack into the bridge and so on) must be only one value, then there's no way to ensure that the frame is tagged with the right VLAN ID (the one it has arrived in the bridge)?

Here on the diagram I'm trying to explain my question:

       +----+
       | L3 |
       +--+-+
          |
          |
          |br0
   +------+-------+
   | Linux Bridge |
   +------+-------+
          |trunk (vid 2-4094)
          |PVID (??)
          |
   +------+-------+
   |   L2 switch  |
   +-+----+-----+-+
     |    |     |
     |    |     |
   10|  20|   30|

For example, a frame tagged with VID 10 (heading towards br0) arrives on the Linux bridge trunk port, the tag will be stripped off and handed over to the stack, processed (for example ICMP) and a response packet is generated back, which enters the bridge from br0 and will be tagged with PVID, and if I set PVID=20, then such packet will never reach a host on the VLAN10?

I was expecting that the Linux bridge would be able to forward reply packet based on destination MAC and VLAN ID of the original packet.

UPDATE After some experiments I found that the following setup works. So create Vlan sub-interfaces ethX.VID and add them in the bridge, then tag/untag is done per at sub-interface, br0 has single IP address.

I.e. tagged packets (multiple VLANs) reach br0, get untagged, pushed up the stack, and response packets go all the way back via br0 into a proper Vlan sub-interface, where it's get tagged and outside.

       +----+
       | L3 |
       +--+-+
          |
          |
          |br0
   +------+-------+
   | Linux Bridge |
   +------+-------+
    |      |     |
   |      |       |
 |eth0.10|eth0.20|eth0.30|
       +------+
       | eth0 |
       +--+---+
          |trunk (vid 2-4094)
          |PVID (??)
          |
   +------+-------+
   |   L2 switch  |
   +-+----+-----+-+
     |    |     |
     |    |     |
   10|  20|   30|
Improve this question
7
  • 1
    PVID is for untagged frames entering the bridge. The routing stacks creates only packets which once put in an Ethernet frame are untagged frames. untagged is to strip VLAN frames once they leave the bridge. once untagged the information is lost for further processing. At the same time the routing (ie: layer 3) handles IPv4(+ARP) or IPv6 packets, it doesn't handle and will ignore (read: drop) VLAN frames. You're asking about something you'd like to have but don't. But you didn't ask about the actual problem you have to solve.
    – A.B
    Apr 19, 2022 at 14:29
  • 1
    For above example, you can create br0.10 br0.20 and br0.30 vlan interfaces and have them handle traffic as usual, as long as routing is done properly on both sides. This could even be done over veth interfaces with one side attached as bridge port instead of on the bridge interface.
    – A.B
    Apr 19, 2022 at 14:34
  • @A.B Thanks for your comments! For above example, you can create br0.10 br0.20 and br0.30 vlan interfaces and have them handle traffic as usual Do you suggest not to have a bridge, but instead VLAN sub-interfaces?
    – Mark
    Apr 19, 2022 at 15:21
  • Or you use bridge ports + veth and leave the bridge interface alone in its vlan 1. Then you don't need vlan sub interfaces since for each port you can have an untagged pvid setting. Need 4093 of them? Create 4093 ports (actually you might hit technical limits before this)
    – A.B
    Apr 19, 2022 at 15:23
  • you can create br0.10 br0.20 and br0.30 vlan interfaces and have them handle traffic as usual, as long as routing is done properly on both sides. Did some experiments and found a working solution (please see my updated question). I'm still unclear how having br0.10 br0.20 and br0.30 will work: basically (correct me if I'm wrong) we still have a bridge (vlan unaware?), which does L2 between its ports and possibly some VLAN filtering (in this case it's vlan-aware), but all the packets with dest MAC of the host land on one of br0.XX. But would each br0.XX require its own IP address?
    – Mark
    Apr 27, 2022 at 4:24

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.