A Virtual Local Area Network, commonly known as VLAN, is a logically independent computer network. Multiple VLANs can coexist on the same network switch.
Installation
First, you need to check if VLAN support is compiled as a module or integrated into the kernel:
# /etc/modules: kernel modules to load at boot time.## This file contains the names of kernel modules that should be loaded# at boot time, one per line. Lines beginning with "#" are ignored.# Parameters can be specified after the module name.8021q
...
To configure my VLAN, it's quite simple. I need to know on which physical interface (br0 in this case) I'll create my VLAN (110), then I can create my VLAN on-the-fly like this:
Here's an example that works with OpenVZ, but also works well for other classic use cases.
You may need to create VLANs in your VEs. This works very well with a bridged interface. To do this, on the host machine, you need to have a VLAN configured (for setup, use this documentation). For those who still want an example:
# This file describes the network interfaces available on your system# and how to activate them. For more information, see interfaces(5).# The loopback network interfaceautolo
ifaceloinetloopback
# The primary network interfaceallow-hotplugeth0
autoeth0
ifaceeth0inetmanual
# The bridged interfaceautovmbr0
ifacevmbr0inetstatic
address192.168.100.1
netmask255.255.255.0
gateway192.168.100.254
broadcast192.168.100.255
network192.168.100.0
bridge_portseth0
bridge_fd9bridge_hello2bridge_maxage12bridge_stpoff
# The DMZ Vlan 110autovmbr0.110
ifacevmbr0.110inetstatic
address192.168.110.1
netmask255.255.255.0
broadcast192.168.110.255
vlan_raw_devicevmbr0
This example is made with a bridged interface because I have KVM running on it, but you're not obligated to use a bridge.
Then, when creating your VE, you don't have to do anything special when creating the network interface for your VE. Launch the creation of your VE and don't forget to install the "vlan" package to create VLAN access within your VE. Here's another example of the network configuration for the VE:
For the VE configuration, it's almost identical to the host machine. You'll need to create a VLAN interface on the main interface (again, you don't need to configure the main interface, just the VLAN is enough). For those who are still unsure, here's an example configuration in a VE:
# This configuration file is auto-generated.# WARNING: Do not edit this file, your changes will be lost.# Please create/edit /etc/network/interfaces.head and /etc/network/interfaces.tail instead,# their contents will be inserted at the beginning and at the end# of this file, respectively.## NOTE: it is NOT guaranteed that the contents of /etc/network/interfaces.tail# will be at the very end of this file.# Auto generated lo interfaceautolo
ifaceloinetloopback
# VE interfaceautoeth0
ifaceeth0inetmanual
# VLAN 110 interfaceautoeth0.110
ifaceeth0.110inetstatic
address192.168.110.2
netmask255.255.255.0
gateway192.168.110.254
broadcast192.168.110.255
vlan_raw_deviceeth0
KVM
We will need to use etables (iptables for bridged interfaces). Install this:
# This file describes the network interfaces available on your system# and how to activate them. For more information, see interfaces(5).# The loopback network interfaceautolo
ifaceloinetloopback
# The primary network interfaceallow-hotplugeth0
autoeth0
ifaceeth0inetmanual
autoeth0.110
ifaceeth0.110inetmanual
vlan_raw_deviceeth0
# The bridged interfaceautovmbr0
ifacevmbr0inetstatic
address192.168.100.1
netmask255.255.255.0
network192.168.100.0
broadcast192.168.100.255
gateway192.168.100.254
# dns-* options are implemented by the resolvconf package, if installeddns-nameservers192.168.100.254
dns-searchdeimos.fr
bridge_portseth0
bridge_fd9bridge_hello2bridge_maxage12bridge_stpoff
autovmbr0.110
ifacevmbr0.110inetstatic
address192.168.110.1
netmask255.255.255.0
bridge_portseth0.190
bridge_stpoff
bridge_maxwait0bridge_fd0