# [HOWTO] VLANs in a Snap with Gentoo

## flickerfly

I've been meaning to figure this out, so today I did and it's so easy I thought I'd post a guide so people don't put it off like I did thinking it complicated.

First, let me explain the differences between the Linux and Cisco implementations of 802.1q. 802.1q is the standards-based trunking protocol, meaning it allows the carrying of multiple VLANs. Cisco has another protocol that they used first, but most devices can use both. Being OSS fans, we like the standards so we'll stick with 802.1q.

Cisco uses one port to communicate with all VLANs in an 802.1q trunk. Linux splits this task, one VLAN per virtual NIC. Gentoo will setup these Virtual NICs for you once you tell it what to expect.

Assumptions

I'm assuming that your switches already have VLANs setup and that you simply want to add Linux to the mix. I also assume that your using the cisco port FastEthernet 0/1, that your linux box is using eth1 for this exercise and that you have 3 vlans setup on the Cisco device with the IDs, 1 2 3.

Cisco VLAN Setup

Setup the Cisco port for an 802.1q trunk first if that is what is on the other end. If a Linux device, just do the Linux side twice. If you have a different VLAN capable device, you'll have to consult your vendor's documentation and get back to us with a comment here to tell us how to do it.

For the 2900XL, Log into the IOS and type the following commands:

```
en

password: <enter enable password>

config t

int fa 0/1

shut

switchport trunk encapsulation dot1q

switchport mode trunk

no shut
```

or on the 2500:

```
enable

config terminal

interface fastethernet 0/1

shutdown

switchport mode trunk

switchport trunk access allowed vlan <all / vlan ID>

no shutdown 
```

You should also remove any other confugrations for the port that are out of date such as setting the port for a specific vlan with a command like:

```
no switchport access vlan $vlanID
```

Installing Needed Software

The following command should show if you have VLAN support in you kernel.

```
grep CONFIG_VLAN_8021Q /usr/src/linux/.config
```

If you see

```
# CONFIG_VLAN_8021Q is not set
```

You need to config your kernel to set this up as a module and then issues the following commands. It will work on either the current 2.4 or 2.6 kernels in portage.

```
cd /usr/src/linux

make modules

make modules_install
```

Mine is built as a module so I see the line

```
CONFIG_VLAN_8021Q=m
```

Once you have the above worked out, 

```
modprobe 8021q
```

Then make sure you have the directory /proc/net/vlan/ and it includes a file called config. That is a sure sign that you have vlan compatability in your kernel.

Final for software setup: 

```
emerge vconfig
```

NIC Setup

To setup the VLANs you want to talk to you must edit your net configuration in /etc/conf.d/net. You'll want to remove any current configuration for your NIC and enter something akin to the following:

```
ifconfig_eth1=( "0.0.0.0" )

vlans_eth1="1 2 3"

ifconfig_eth1_1=( "10.0.20.254 broadcast 10.0.20.255 netmask 255.255.255.0" )

ifconfig_eth1_2=( "dhcp" )

ifconfig_eth1_3=( "dhcp" )
```

or for iproute2:

```
ipaddr_eth1=( "0.0.0.0" )

vlans_eth1="1 2 3"

ipaddr_eth1_1=( "10.0.20.254/24 brd 10.0.20.255" )

ipaddr_eth1_2=( "dhcp" )

ipaddr_eth1_3=( "dhcp" ) 

```

You'll notice that the ifconfig_ethX_N variable is given the same sort of configuration that your previous ifconfig_ethX variables had. Additionally, the variable ifconfig_ethX_vlans contains a list of the vlans you want to talk to.

Start it all up

Now all you have to do is type /etc/init.d/net.eth1 restart and it should all come up. You will get feedback about the individual interfaces if something goes wrong.

If you get the message  *Quote:*   

> ERROR: trying to add VLAN #1 to IF -:eth2:-  error: Invalid argument

  then check your config in the variable ifconfig_eth2_1 or more accurately the variable of that ilk cooresponding to the indications from the error message.

Conclusion

You should find that /proc/net/vlan now has a file cooresponding to each of the virtual NICs in it. You can look into the file to see the configuration of that virtual NIC in terms of the VLAN setup.

Also, take a look at your routing table, you should notice it has increased in size many fold.

If you want this box to route traffic between VLAN simply issue the following command:

```
echo 1 > /proc/sys/net/ipv4/ip_forward
```

You can find my wiki notes on this subject here . I'd also like to mess around with the [url=http://lcdpd.sourceforge.net/]Linux CDP project[url], evidently it is defunct due to an apparent lack of interest. I have been told that ethreal supports some CDP stuff but haven't played with that yet. I'd appreciate your comments if you've used it. Perhaps we can revive it.

EDIT: Oct. 30, 2004

* Thanks to UberLord for the new variables in /etc/conf.d/net and also including the ones for iproute2.

* Thanks to Gentoo Box for the Cisco 2500 configuration.

* While I'm at it thanks, to all those showing appreciation for the guide.  :Smile: 

* Updated my CDP Comment to reflect new information.

----------

## Strenuus

Thank you so much flickerfly, I too have been putting this off for a while now and didn't think it would have been that simple.  Thank you for the simpe howto.

----------

## flickerfly

My pleasure, I figured there had to be at least one other person out there waiting for this.

----------

## Strenuus

 *flickerfly wrote:*   

> I'd also like to mess around with the Linux CDP project

 

Have you had any luck on getting Linux CDP working and do you know if there is a ebuild for it somewhere in portage?

----------

## flickerfly

Apparently the Linux CDP project died due to lack of interest. I hear that Ethreal supports the sniffing of CDP though. I haven't played with that yet.

----------

## UberLord

 *flickerfly wrote:*   

> 
> 
> To setup the VLANs you want to talk to you must edit your net configuration in /etc/conf.d/net. You'll want to remove any current configuration for your NIC and enter something akin to the following:
> 
> ```
> ...

 

Just a note to say that the variables you've used were depreciated some time ago - although they should still work

The new settings should be

```

ifconfig_eth1=( "0.0.0.0" )

vlans_eth1="1 2 3"

ifconfig_eth1_1=( "10.0.20.254 broadcast 10.0.20.255 netmask 255.255.255.0" )

ifconfig_eth1_2=( "dhcp" )

ifconfig_eth1_3=( "dhcp" )

```

or for iproute2

```

ipaddr_eth1=( "0.0.0.0" )

vlans_eth1="1 2 3"

ipaddr_eth1_1=( "10.0.20.254/24 brd 10.0.20.255" )

ipaddr_eth1_2=( "dhcp" )

ipaddr_eth1_3=( "dhcp" )

```

----------

## flickerfly

What is the benefit of the new ones? I don't see any change outside the variable name. What do I gain?

----------

## ali3nx

nice   :Very Happy: 

I'll be making use of this in short order at the isp i work for! Thanks

----------

## UberLord

 *flickerfly wrote:*   

> What is the benefit of the new ones? I don't see any change outside the variable name. What do I gain?

 

For the vlans variable - nothing as it's just a name change to bring it inline with our other variables

For the others, you gain the ability to easily define aliases like so

```
ifconfig_eth0=( "192.168.0.1 netmask 255.255.255.0"

         "192.168.0.2 netmask 255.255.255.0"

         "dhcp" )
```

This creates eth0, and two aliase eth0:1 and eth0:2

You need to use this structure when defining tun/tap or bridge interfaces if you need to give them an address (note - not availble in portage yet)

```
ifconfig_eth0=( "tuntap" "192.168.0.1 netmask 255.255.255.0" )
```

Hopefully you can now see why we're encouraging the new variables  :Smile: 

----------

## GentooBox

what ! is there a CDP for linux ?  :Very Happy:  thats awsome.

nice guide BTW.

and thanks for useing dot1q instead of ISL.  :Smile: 

 *Quote:*   

> en
> 
> password: <enter enable password>
> 
> config t
> ...

 

this is how its done on Cisco 2500 switches.

```

enable

config terminal

interface fastethernet 0/1

shutdown

switchport mode trunk

switchport trunk access allowed vlan <all / vlan ID>

no shutdown

```

Cisco 2500 switches only supports dot1q, so its enabled by default.

EDIT: you dont have to shutdown the interface before useing trunk, Cisco switches restart the interface by itself.

----------

## flickerfly

 *GentooBox wrote:*   

> you dont have to shutdown the interface before useing trunk, Cisco switches restart the interface by itself.

 

True, however, it is considered best practice. Other devices are less likely to see the port going up and down. I don't think any massive consequences would occur if you didn't.

----------

## flickerfly

Thanks to UberLord and GentooBox for providing improvements to the original guide. I've integrated your additions above.

----------

## flickerfly

 *UberLord wrote:*   

>  *flickerfly wrote:*   
> 
> To setup the VLANs you want to talk to you must edit your net configuration in /etc/conf.d/net. You'll want to remove any current configuration for your NIC and enter something akin to the following:
> 
> ```
> ...

 

I've not been able to make the ipaddr stuff work at all and looking at my init.d/net.ethX file, it hasn't a chance. ifconfig stuff works, but I still have to use the old iface_eth1_vlans="1 2 3" bit. Is this a result of features not yet in stable?

----------

## UberLord

 *flickerfly wrote:*   

> I've not been able to make the ipaddr stuff work at all and looking at my init.d/net.ethX file, it hasn't a chance. ifconfig stuff works, but I still have to use the old iface_eth1_vlans="1 2 3" bit. Is this a result of features not yet in stable?

 

You're right - the iface_eth1_vlans variable is still required for stable (must remember this - lol).

ipaddr is very flaky in stable - broken for the most part. I can assure you that it's rock solid in unstable  :Smile: 

However, as you're obviously clued up about vlan, how about trying out baselayout-1.11.6-r1 or better and giving me some feedback about vlan working or not   :Cool: 

----------

## flickerfly

 *UberLord wrote:*   

> However, as you're obviously clued up about vlan, how about trying out baselayout-1.11.6-r1 or better and giving me some feedback about vlan working or not  

 

Sure is there a bug I should post my results under?

----------

## UberLord

 *flickerfly wrote:*   

>  *UberLord wrote:*   However, as you're obviously clued up about vlan, how about trying out baselayout-1.11.6-r1 or better and giving me some feedback about vlan working or not   
> 
> Sure is there a bug I should post my results under?

 

You can post here or create a new bug @ bugs.gentoo.org

----------

## flickerfly

I'm going to need a quick tutorial on unmanking that package. I know how to do it the old way, but haven't fully understood the new method yet.

----------

## UberLord

 *flickerfly wrote:*   

> I'm going to need a quick tutorial on unmanking that package. I know how to do it the old way, but haven't fully understood the new method yet.

 

```

mkdir /etc/portage

echo "sys-apps/baselayout ~x86" >> /etc/portage/package.keywords

echo "=sys-apps/sysvinit-2.85-r1 ~x86" >> /etc/portage/package.keywords

echo "=sys-libs/readline-5.0-r1 ~x86" >> /etc/portage/package.keywords

echo "=app-shells/bash-3.0-r7 ~x86" >> /etc/portage/package.keywords

emerge -uaDv world

```

----------

## tecknojunky

I have many difficulties.  I always wondered why Gentoo has to complicate things by abstracting the network configuration.

I simply want to route traffic between two vlans.  Following your howto, compared to when I do a manual configuration, I end up with eth0 having an ipv6 address, unable to define a default gateway and with SIOCSIFMTU error, probably due to the mtu 1504 defined in your wiki.  I also have to spoof the mac address.

So here is how I configured /etc/conf.d/net

```
ifconfig_eth0=( "0.0.0.0 hw ether 00:04:E2:7D:93:C3 mtu 1504" )

vlans_eth0="0 1"

ifconfig_eth0_0=( "192.168.0.1 broadcast 192.168.0.255 netmask 255.255.255.0" )

ifconfig_eth0_1=( "nnn.nnn.nnn.nnn broadcast nnn.nnn.nnn.255 netmask 255.255.255.0" )

 

# For setting the default gateway

#

gateway="eth0/nnn.nnn.nnn.1"
```

That's just to establish the connections.  I'll deal with the routing later.

Is it possible or do I have to completely rewrite /etc/init.d/net.eth0 (which I'm very much tempted to do).

----------

## flickerfly

 *tecknojunky wrote:*   

> I have many difficulties.  I always wondered why Gentoo has to complicate things by abstracting the network configuration.
> 
> I simply want to route traffic between two vlans.  Following your howto, compared to when I do a manual configuration, I end up with eth0 having an ipv6 address, unable to define a default gateway and with SIOCSIFMTU error, probably due to the mtu 1504 defined in your wiki.  I also have to spoof the mac address.
> 
> So here is how I configured /etc/conf.d/net
> ...

 

Try the old config. It's best on a stable system and be sure of 802.1q trunking vs Cisco's proprietary ISL(I think in the name)

```
iface_eth1="0.0.0.0"

iface_eth1_vlans="1 2 3"

iface_eth1_1="10.0.20.254 broadcast 10.0.20.255 netmask 255.255.255.0"

iface_eth1_2="dhcp"

iface_eth1_3="dhcp"
```

----------

## gtsquirrel

Hey,

Thanks for posting this!  I was about to add my own /etc/init.d/vlan script to handle this apart from the regular Gentoo network initialization.  I did have a few questions, though.

vconfig has lots of different options, so I'm wondering how to customize that in the /etc/conf.d/net file.  How can I specify a PER_DEVICE or a PER_KERNEL bind-type?  And how can I specify a naming scheme to use?  (VLAN_PLUS_VID, VLAN_PLUS_VID_NO_PAD, DEV_PLUS_VID, DEV_PLUS_VID_NO_PAD)

I took a brief look at the code in /etc/init.d/net.eth0, but didn't really see anything that looked to be for this.

Thanks!

chris

----------

## tecknojunky

Well, I finaly got fed up learning stuff way too off and complicated.  I decided to simply put the ifconfig and route commands directly into the net.eth0 script.  Suddenly, life became much simpler.

----------

## UberLord

 *gtsquirrel wrote:*   

> 
> 
> vconfig has lots of different options, so I'm wondering how to customize that in the /etc/conf.d/net file.  How can I specify a PER_DEVICE or a PER_KERNEL bind-type?  And how can I specify a naming scheme to use?  (VLAN_PLUS_VID, VLAN_PLUS_VID_NO_PAD, DEV_PLUS_VID, DEV_PLUS_VID_NO_PAD)

 

At present you can't - not even in unstable baselayout-1.11.6-r1.

Hopefully have something in next release of baselayout  :Smile: 

----------

## gtsquirrel

Actually, it appears as though PER_DEVICE and PER_KERNEL support has been stripped from vconfig 1.8.  I wonder what else they've changed ...

Thanks!

chris

----------

## tecknojunky

Bummer, another tile fell on my head.  :Sad:    iptables do not support aliases or vlans.  So, I've put in a second nic.  

The downside is that it's connected to the same switch, so I'm using two ports.  Kinda dumb when you know the switch and Linux can both talk vlan.

It would seem that iptables2 could do that, but it looked radically different in terms of commands, and I need a router now, not in two months.

----------

## flickerfly

 *tecknojunky wrote:*   

> Bummer, another tile fell on my head.    iptables do not support aliases or vlans.  So, I've put in a second nic.  
> 
> The downside is that it's connected to the same switch, so I'm using two ports.  Kinda dumb when you know the switch and Linux can both talk vlan.
> 
> It would seem that iptables2 could do that, but it looked radically different in terms of commands, and I need a router now, not in two months.

 

Really! I've been using it a little with iptables. Granted, I haven't gone into it extensively, but it seems to be doing as I request. I've just been specifying the eth1.1 or whatever NIC and it seems to work fine. What draws you to this conclusion? That would change some of my plans also.

----------

## gtsquirrel

I know that at least iptables 1.2.11 supports VLANs.  Example:

```
aeryn root # iptables -A INPUT -i eth1.5 -j ACCEPT

aeryn root # iptables -L -v

Chain INPUT (policy ACCEPT 31 packets, 2332 bytes)

 pkts bytes target     prot opt in     out     source               destination

    0     0 ACCEPT     all  --  eth1.5 any     anywhere             anywhere

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 16 packets, 1632 bytes)

 pkts bytes target     prot opt in     out     source               destination
```

Voila!  Just make sure you set the switch properly.  For a Catalyst 2950:

```
switch(config)#interface FastEthernet0/24

switch(config-if)#switchport mode trunk

switch(config-if)#spanning-tree portfast trunk

switch(config-if)#no shutdown
```

That's working just fine on my box here.  If you need specific help with IOS, shoot me an e-mail.

----------

## tecknojunky

Oh!  :Shocked:  I was specifying eth0:0, just like in ifconfig  :Embarassed:  .  I will have to try that when I get back to the lab on monday.

 *gtsquirrel wrote:*   

> If you need specific help with IOS, shoot me an e-mail.

 I will definitly accept the offer.  I still haven't configure the switch yet.  For now, it still operates as a flat switch.  It's a SMC b.t.w.  It talks Cisco dialect.

----------

## gtsquirrel

 *Quote:*   

> Oh! Shocked I was specifying eth0:0, just like in ifconfig Embarassed . I will have to try that when I get back to the lab on monday.

 

Yes, this does not work.  I had a little discussion on the iptables mailing list last month about using alias interfaces.  As it turns out, the kernel thinks anything inbound to ethX:Y actually comes from interface ethX (where X and Y are totally arbitrary values).  As such, the proper way to write iptables rules for this is as follows, using eth0:1 as 192.168.1.1 and eth0:2 as 192.168.2.1:

```
iptables -P INPUT DROP

iptables -A INPUT -i eth0 -d 192.168.1.1 -p tcp -j ACCEPT

iptables -A INPUT -i eth0 -d 192.168.2.1 -p udp -j ACCEPT
```

Sometimes in my firewall scripts I abstract the -i eth0 -d 192.168.1.1 part into a simple variable like ${eth0_1}.  Just makes things easier.   :Smile: 

 *Quote:*   

> I will definitly accept the offer. I still haven't configure the switch yet. For now, it still operates as a flat switch. It's a SMC b.t.w. It talks Cisco dialect.

 

FYI, though, most new Cisco switches come pre-configured with all their ports in trunk mode, which means you do have to configure them to work as a plain switch.  The Dell PowerConnects and some other vendors' switches use an IOS-like CLI (command line interface), but there are distinctive differences.  I'll give as much advice as possible, but at some point you may just have to consult the documentation.   :Wink: 

Also, some of the readers of this posting might be interested in my exploits with Cisco's EtherChannel.  There is another thread open under the Networking section for that particular subtopic.

----------

## tecknojunky

I'm new to this.  I'm still using ipfwadm on an old 486 to do all the firewalling/NAT-routing on my home LAN.  Here, I wish to finally go to for the higher level  :Very Happy:  with iptables.  So I learn there is iproute2 that use the ip command.... way too much for little me right now.  :Embarassed:  I have a cluster to build  :Wink: 

----------

## gtsquirrel

One day, grasshopper ...  :Wink: 

----------

## drakkan

Hi,

I have some trouble with 3c905B driver and vlan, can you suggests wath chip do you use?

thanks

drakkan

----------

## drakkan

 *drakkan wrote:*   

> Hi,
> 
> I have some trouble with 3c905B driver and vlan, can you suggests wath chip do you use?
> 
> thanks
> ...

 

I have now tested an intel pro 100 and works fine, instead with 3c905B when I attempt to transfer a file there is a timeout, this is my lspci:

 0000:00:00.0 Host bridge: VIA Technologies, Inc. VT82C693A/694x [Apollo PRO133x] (rev c4)

0000:00:01.0 PCI bridge: VIA Technologies, Inc. VT82C598/694x [Apollo MVP3/Pro133x AGP]

0000:00:07.0 ISA bridge: VIA Technologies, Inc. VT82C686 [Apollo Super South] (rev 40)

0000:00:07.1 IDE interface: VIA Technologies, Inc. VT82C586A/B/VT82C686/A/B/VT823x/A/C PIPC Bus Master IDE (rev 06)

0000:00:07.2 USB Controller: VIA Technologies, Inc. VT82xxxxx UHCI USB 1.1 Controller (rev 1a)

0000:00:07.4 SMBus: VIA Technologies, Inc. VT82C686 [Apollo Super ACPI] (rev 40)

0000:00:07.5 Multimedia audio controller: VIA Technologies, Inc. VT82C686 AC97 Audio Controller (rev 50)

0000:00:09.0 Ethernet controller: Intel Corp. 82557/8/9 [Ethernet Pro 100] (rev 0c)

0000:00:0a.0 Ethernet controller: 3Com Corporation 3c905B 100BaseTX [Cyclone] (rev 24)

0000:00:0c.0 Ethernet controller: 3Com Corporation 3c905B 100BaseTX [Cyclone] (rev 64)

0000:01:00.0 VGA compatible controller: S3 Inc. Savage 4 (rev 04)

and my ifconfig -a with working vlan on intel pro100:

eth0      Link encap:Ethernet  HWaddr 00:A0:24:50:E5:B2  

          inet addr:10.88.44.20  Bcast:10.88.44.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:1317 errors:0 dropped:0 overruns:0 frame:0

          TX packets:19 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:104071 (101.6 Kb)  TX bytes:1474 (1.4 Kb)

          Interrupt:10 Base address:0xc800 

eth1      Link encap:Ethernet  HWaddr 00:50:04:42:FD:D6  

          BROADCAST MULTICAST  MTU:1500  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:2 errors:0 dropped:0 overruns:0 carrier:2

          collisions:0 txqueuelen:1000 

          RX bytes:0 (0.0 b)  TX bytes:1180 (1.1 Kb)

          Interrupt:11 Base address:0xc400 

eth2      Link encap:Ethernet  HWaddr 00:02:B3:2B:03:DB  

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:537297 errors:0 dropped:0 overruns:0 frame:0

          TX packets:160686 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:779506973 (743.3 Mb)  TX bytes:11253068 (10.7 Mb)

eth2.2    Link encap:Ethernet  HWaddr 00:02:B3:2B:03:DB  

          inet addr:10.88.22.254  Bcast:10.88.22.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:537249 errors:0 dropped:0 overruns:0 frame:0

          TX packets:160686 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:771978530 (736.2 Mb)  TX bytes:11253068 (10.7 Mb)

eth2.3    Link encap:Ethernet  HWaddr 00:02:B3:2B:03:DB  

          inet addr:10.88.11.254  Bcast:10.88.11.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:2 errors:0 dropped:0 overruns:0 frame:0

          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:471 (471.0 b)  TX bytes:0 (0.0 b)

gre0      Link encap:UNSPEC  HWaddr 00-00-00-00-FF-00-00-00-00-00-00-00-00-00-00-00  

          NOARP  MTU:1476  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

lo        Link encap:Local Loopback  

          inet addr:127.0.0.1  Mask:255.0.0.0

          UP LOOPBACK RUNNING  MTU:16436  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

tunl0     Link encap:IPIP Tunnel  HWaddr   

          NOARP  MTU:1480  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

there is a workaroud for 3c905B ? 

thanks

drakkan

----------

## flickerfly

Have you tried adjusting the MTU? I think there are directions in this post somewhere. I know they are on the web around the subject of VLANs and Linux. I think it just requires adding `mtu 1549` to the NIC params.

----------

## masterbrian

 *flickerfly wrote:*   

> 
> 
> Try the old config. It's best on a stable system and be sure of 802.1q trunking vs Cisco's proprietary ISL(I think in the name)
> 
> ```
> ...

 

Thank you four your howto. this is exactly what I'm looking for.

But at this moment I'm unable to use it even with old style configuration under stable environment. In this moment I'm trying to upgrade my baselayour, but I'm not to happy about this, because I'm working on a production server.

With stable environment I'm unable to start vlan interfaces when net.eth1 start, and I don't understain why. net.eth1 starts well, but I get no even a error for vlan interfaces ...

----------

## masterbrian

Good!!! under unstable environment it works!  :Smile:  I hope it isn't too much unstable... what about your experiences?

----------

## UberLord

Aside from a few teething problems, baselayout-1.11.8 is fairly stable - there's still a few gotchas, but patches have been posted to bugzilla if you encounter one.

If not, let us know so we can fix it  :Smile: 

----------

## flickerfly

I've been using the unstable and seen no related issues. I think I've been running for over a month.

----------

## addlema

So I have the 802.1Q in my kernel as built in.. but i dont have the  /proc/net/vlan/ directory?

What did i do wrong? Can someone post what should be in there and Ill create in manually?

root@magnus linux # grep CONFIG_VLAN_8021Q /usr/src/linux/.config

CONFIG_VLAN_8021Q=y

root@magnus linux # 

root@magnus net # ls

arp               dev_mcast     ip_conntrack_expect  ip_tables_names    mcfilter  packet  rpc       sockstat      tcp

arp_tables_names  igmp          ip_queue             ip_tables_targets  netlink   raw     rt_cache  softnet_stat  udp

dev               ip_conntrack  ip_tables_matches    ipt_recent         netstat   route   snmp      stat          unix

root@magnus net #

----------

## flickerfly

Did you...

```
modprobe 8021q

emerge vconfig
```

Does 'lsmod' show 8021q?

----------

## tekn0mage

I have read this document thoroughly, and can get VLAN's going while using 'vconfig' manually. Then setting each if_vid manually with ifconfig works beautifully.

When I try to launch it with the /etc/init.d/net.eth1 script, the only interface that appears is eth1 (with no ip address assigned).

Here is a copy of my conf.d/net file:

```

# /etc/conf.d/net:

# $Header: /home/cvsroot/gentoo-src/rc-scripts/etc/conf.d/net,v 1.7 2002/11/18 19:39:22 azarah Exp $

# Global config file for net.* rc-scripts

# This is basically the ifconfig argument without the ifconfig $iface

#

iface_eth0="xx.xx.xx.xx broadcast xx.xx.xx.xx netmask 255.255.255.248"

ifconfig_eth1="0.0.0.0"

vlans_eth1="1 201 210"

ifconfig_eth1_1="10.0.0.1 broadcast 10.0.0.255 netmask 255.255.255.0"

ifconfig_eth1_201="10.0.1.1 broadcast 10.0.1.255 netmask 255.255.255.0"

ifconfig_eth1_210="10.0.2.1 broadcast 10.0.2.255 netmask 255.255.255.0"

```

I even tried replacing 'ifconfig' with 'iface' and the same thing happens.

Any ideas?

I would really like to automate this in case the box dies, I dont want a network outage  :Sad: 

Thanks.

----------

## flickerfly

here's my current working config. The only thing I notice is the ( and ) surrounding the quotes for the value of the various vlan variables. Maybe that will help?

```
ifconfig_eth1=( "0.0.0.0" )

iface_eth1_vlans="1 225 200 300"

ifconfig_eth1_1=( "10.0.25.6 broadcast 10.0.25.255 netmask 255.255.255.0" )

ifconfig_eth1_200=( "10.0.1.15 broadcast 10.0.1.255 netmask 255.255.255.0" )

ifconfig_eth1_300=( "10.0.0.1 broadcast 10.0.0.255 netmask 255.255.255.0" )

ifconfig_eth1_225=( "10.0.20.1 broadcast 10.0.20.255 netmask 255.255.255.0" )

```

----------

## SavageMindz

Hi right i think this is basically working now. Thanks for the howto.

Just one thing though. I seem to have trunking going but not in vlan 1. I did a search and because vlan 1 from cisco does not include the header it doesnt seem to work. All the other vlans work as expected though. 

Does anyone know a workaround for this (other than just moving all the ports to a different vlan which is what I have done).

Cheers

Savage

----------

## flickerfly

VLAN 1 is supposed to be different. Most people seem to say, just doen't use 1 for anything. Problem is that VLAN 1 is apperently the native VLAN and older equipment doesn't allow you to change that. I'd like a workaround also as using VLANs has lost me the ability to manage my switches remotely.

This is due to the fact that VLAN 1 is not used on any network as that is generally considered as security best practice.

----------

## gargola

You need the following before moving on with this POST:

vlan and bridging support compiled in kernel or loaded as modules &

emerge vconfig && emerge bridge-utils

Since I do use all of the above (title), and I could not find a place where it was better explained I wrote the following post just to explain how I figured it out.

I need the following:

1. Establish the VLAN (eth0.1 and eth0.50)

2  Establish a bridge between a NIC an a VLAN interface (br0 = eth0.1 and eth1)

3. Give this bridge a Static IP  br0 = ???.???.???.??? and IPv6

I also have another VLAN which is configured with dhcpcd (eth0.50)

/etc/conf.d/net

```

iface_eth0_vlans="1 50"

iface_eth0_50="dhcp"

dhcpcd_eth0_50="-d -N -R -G"

iface_br0="172.20.46.90 broadcast 172.20.46.255 netmask 255.255.224.0"

```

In my case use a dhcp connection passing some options to the daemon. 

Note that there is no configuration parameters for eth0.

/etc/init.d/net.eth0

Due to the fact that I need my vlans to be created before my bridges since I will be bridging eth1 with eth0.1 I need the vlans to be established before the bridges. Therefore I added "before bridge" to /etc/init.d/net.eth0

```

depend() {

        before bridge

        use hotplug pcmcia

}
```

I also removed (commented out) the first lines of the checkconfig part in /etc/init.d/net.eth0 so that the script does not complain about not any eth0 being initialized (given an IP) as follows:

```

#       if [[ -z "${ifconfig_IFACE}" ]]; then

#               eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"

#               eerror "(or \$iface_$IFACE for old-style configuration)"

#               return 1

#       fi

```

/etc/init.d/bridge

I also added the following lines to this file just to make sure that the eth0 vlans were made before initialising the bridge: need net.eth0

```

depend() {

        need net.eth0

        use modules

}

```

 /etc/conf.d/bridge 

The bridge configuration:

```

bridge="br0"

bridge_br0_devices="eth0.1 eth1"

```

This creates a bridge br0 from the two devices eth0.1 and eth1

/etc/init.d/net.br0

I added the need bridge option just to make sure that the bridge is created before an IP Address is assigned to it. 

```
depend() {

        need bridge

        use modules

}

```

After being done with the conf files I added the initscripts to the default runlevel:

 *Quote:*   

> rc-update add net.eth0 default
> 
> rc-update add bridge default
> 
> rc-update add net.br0 default

 

The IPv6 address should work seamlessly due to the fact that you never initialized eth0.

----------

## dcmwai

ok Until now the way to make it work is like 

** ifconfig_eth1_vlans="1 2 3" **

is the line that causing all my problem.

 *Quote:*   

> 
> 
> ifconfig_eth1=( "0.0.0.0" )
> 
> ifconfig_eth1_vlans="1 2 3"
> ...

 

BUT I've problem shutdown them...

Any idea?

----------

## drakkan

This is the setup for baselayout-1.11.12-r4, now stable

in my setup I have configured vlans on eth1

/etc/con.d/net:

```

config_eth1=( "null" )

vlans_eth1="2 3 4 5 8"

vconfig_eth1=( "set_name_type VLAN_PLUS_VID_NO_PAD" )

config_vlan2=( "10.88.22.253 netmask 255.255.255.0" )

config_vlan3=( "10.88.11.253 netmask 255.255.255.0" )

config_vlan4=( "10.88.33.253 netmask 255.255.255.0" )

config_vlan5=( "10.88.55.253 netmask 255.255.255.0" )

config_vlan8=( "10.88.66.253 netmask 255.255.255.0" )

```

make the link for net.eth1

```

ln -s /etc/init.d/net.lo /etc/init.d/net.eth1

```

start eth1

```

/etc/init.d/net.eth1 start

 * Starting eth1

 *   Bringing up eth1                                                     [ ok ]

 *   Adding VLAN 2 to eth1                                                [ ok ]

 *   Bringing up vlan2

 *     10.88.22.253                                                       [ ok ]

 *   Adding VLAN 3 to eth1                                                [ ok ]

 *   Bringing up vlan3

 *     10.88.11.253                                                       [ ok ]

 *   Adding VLAN 4 to eth1                                                [ ok ]

 *   Bringing up vlan4

 *     10.88.33.253                                                       [ ok ]

 *   Adding VLAN 5 to eth1                                                [ ok ]

 *   Bringing up vlan5

 *     10.88.55.253                                                       [ ok ]

 *   Adding VLAN 8 to eth1                                                [ ok ]

 *   Bringing up vlan8

 *     10.88.66.253                                                       [ ok ]

```

and finally add to default runlevel

```

rc-update add net.eth1 default

```

----------

## flickerfly

Why link eth1 to lo? What advantage does that give? Maybe stability if eth0 goes down?

----------

## drakkan

 *flickerfly wrote:*   

> Why link eth1 to lo? What advantage does that give? Maybe stability if eth0 goes down?

 

Look at the baselayuot ebuild, I think this is the new way to manage network devices now that baselayout-1.11.12-r4 is stable  :Smile: 

from baselayout ebuild:

```

for f in /etc/init.d/net.eth*; do

        [[ -L ${f} ]] && continue

        echo

        einfo "WARNING: You have older net.eth* files in ${ROOT}/etc/init.d/"

        einfo "They need to be converted to symlinks to net.lo.  If you haven't"

        einfo "made personal changes to those files, you can update with the"

        einfo "following command:"

        einfo

        einfo "  # /bin/ls /etc/init.d/net.eth* | xargs -n1 ln -sfvn net.lo"

        echo

        break

    done

```

----------

## flickerfly

Oh, thanks for the code showing the answer.  :Smile: 

----------

## alterself.com

great tutorial. i did as stated in the how-to to get things working and no luck....

here is what i ened up with (AND IT WORKS) after searching google and the forums

```

iface_eth0="172.16.191.9 brd 172.16.255.255 netmask 255.255.0.0"

vlans_eth0="1 10"

config_eth0_1="172.16.201.2 brd 172.16.255.255 netmast 255.255.0.0"

config_eth0_10="dhcp"

```

i KNOW there is a typo...it wont work unless there is...sound strange?

----------

## gilesc

 *alterself.com wrote:*   

> great tutorial. i did as stated in the how-to to get things working and no luck....
> 
> here is what i ened up with (AND IT WORKS) after searching google and the forums
> 
> ```
> ...

 

I believe the default netmask for the 172.16.0.0/12 public networks is 255.255.0.0 have you tried removing netmas* 255.255.0.0 from your configuration completely?

These are just parameters for the ifconfig command, have you checked how the 'ifconfig' command behaves with your typo?

----------

## tecknojunky

My gosh!  I was suprised to find post I made almost 1 year ago in this thread   :Laughing: 

I've made progress...  :Very Happy:  although it does not work yet for the moment.

My problem is that I don't seem to be able to specify a default route.   :Sad: 

Since I don't have the possibility to post here and see the error messages (I'm too lazy to note), I'll describe...

I'm configuring a bond with 'null'.  Then do the bond0_vlan_thing( 2 3 ).  Then do ipaddr_vlan2 and ipaddr_vlan3.

How do I specify the default route?  Trying route_bond0(...) will make it be executed before the vlan's virtual nics are up, and I get some 'network unreacheable' or about.

----------

## alterself.com

I as well have made progress and am working great.

```
vlans_eth0="10"

config_eth0="172.16.191.9 brd 172.16.255.255 netmask 255.255.0.0"

config_eth0_10="192.168.0.3 brd 192.168.0.255 netmask 255.255.255.0"

gateway="eth0.10/192.168.0.1
```

is my entire /etc/conf.net file

this makes me have 1 tagged vlan and one native vlan, with my gateway on vlan10.

----------

## tecknojunky

Ok.  I'll try to be reallu precice.

I have a mass storage unit for which I also want to do routing.  The unit has two 1000Mbps nics and is connected to a vlan capable switch.

What I seek to accomplish is to bond together the two nics to get a pseudo 2000Mbps link, then create two "aliases" each assigned to a different vlan to isolat intranet from internet.

Here's my /etc/conf.d/net:

```
 modules=("iproute2")

slaves_bond0="eth0 eth1"

config_bond0=("null")

vlans_bond0="2 3"

vconfig_bond0=("set_name_type VLAN_PLUS_VID_NO_PAD")

config_vlan2=("192.168.0.4 brd 192.168.0.255 netmask 255.255.255.0")

config_vlan3=("***.***.***.*** brd ***.***.***.255 netmask 255.255.255.0")

gateway=("vlan3/***.***.***.1 mtu 296")
```

When I boot with those, ip addr show prints this:

```
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue

        link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

        inet 127.0.0.1#8 brd 127.255.255.255 scope host lo

        inet6 ::1#128 scope host

                valid_lft forever prefered_lft forever

2: bond0: <BROADCAST,MULTICAST,MASTER,UP> mtu 1500 qdisc noqueue

        link/ether **:**:**:**:**:** brd ff:ff:ff:ff:ff:ff

        inet6 fe80::207:e9ff:fe2e:37c8/64 scope link

                valid_lft forever prefered_lft forever

3: eth0: <BROADCAST,MULTICAST,SLAVE,UP> mtu 1500 qdisc pfifo_fast master bond0 qlen 1000

        link/ether **:**:**:**:**:** brd ff:ff:ff:ff:ff:ff

        inet6 fe80::207:e9ff:fe2e:37c8/64 scope link

                valid_lft forever prefered_lft forever

4: eth1: <BROADCAST,MULTICAST,NOARP,SLAVE,UP> mtu 1500 qdisc pfifo_fast master bond0 qlen 1000

        link/ether **:**:**:**:**:** brd ff:ff:ff:ff:ff:ff

        inet6 fe80::207:e9ff:fe2e:37c8/64 scope link

                valid_lft forever prefered_lft forever

5: vlan2: <BROADCAST,MULTICAST,MASTER,UP> mtu 1500 qdisc noqueue

        link/ether **:**:**:**:**:** brd ff:ff:ff:ff:ff:ff

        inet 192.168.0.4/24 brd 192.168.0.255 scope global vlan2

        inet6 fe80::207:e9ff:fe2e:37c8/64 scope link

                valid_lft forever prefered_lft forever

6: vlan3: <BROADCAST,MULTICAST,MASTER,UP> mtu 1500 qdisc noqueue

        link/ether **:**:**:**:**:** brd ff:ff:ff:ff:ff:ff

        inet ***.***.***.***/24 brd ***.***.***.255 scope global vlan2

        inet6 fe80::207:e9ff:fe2e:37c8/64 scope link

                valid_lft forever prefered_lft forever

7: sit0: <NOARP> mtu 1480 qdisc noop

        link/sit 0.0.0.0 brd 0.0.0.0
```

ip route show gives this:

```
***.***.***.0/24 dev vlan3 proto kernel scope link src ***.***.***.***

192.168.0.0/24 dev vlan2 proto kernel scope link src 192.168.0.4

127.0.0.0/8 dev lo scope link
```

With this, I don't get the default route (even if I remove the mtu 296 part), so I tried setting it up in the postup function and it works.

```
postup() {

        route add default gw ***.***.***.1 mtu 296

        return 0

}
```

with this, the route table looks like this:

```
***.***.***.0/24 dev vlan3 proto kernel scope link src ***.***.***.***

192.168.0.0/24 dev vlan2 proto kernel scope link src 192.168.0.4

127.0.0.0/8 dev lo scope link

default via ***.***.***.1 dev vlan3 advmss 256
```

Alas, I get Network unreacheable whenever I try to communicate on the link.

(there may be a couple of typos as I had to note all of this stuff on a piece of paper and then type it down here).

----------

## alterself.com

wow...sounds like an idea thats for sure. All I am doing is simple VLAN'n so I'm afraid I am outta my league here for helping you out with your problem.

I think it was this thread I posted to a while back for help about vlans, and how they woldnt work w/o a typo or two, but with the most recent baselayout that issue has gone away. yay!

----------

## tecknojunky

 :Very Happy:  Thanks anyway.

I guess I will copy/paste the post into a brand new thread.  I really am stuck.   :Crying or Very sad: 

----------

