VLANs make it possible to separate large networks into smaller and manageable ones. The 802.1Q is a standard which is implemented by all vendors into their network equipment. Some switches have the ability to assign multiple VLANs to a single network port. With this feature, you can assign multiple VLANs to a single server. The switch can separate the packages because every Ethernet frame is tagged with the VLA
- The network switch your server is connected to must be set up for a successful procedure
- The switch should support VLAN tagging
- You must be logged in via SSH as sudo or root user. This tutorial assumes that you are logged in as a sudo user.
Step 1 – Log in using SSH
You must be logged in via SSH as sudo or root user. Please view this article for instructions if you don’t know how to connect.
Step 2 – Install dependency
sudo apt-get install vlan
Step 3 – Create network routes
Edit the following file in order to allow multiple VLANs on your server to create routing tables.
sudo nano /etc/iproute2/rt_tables
Add the following lines.
500 firsttable 501 secondtable
Step 4 – Find the active network interface
clear && echo $(ip -o -4 route get 22.214.171.124 | sed -nr 's/.*dev ([^\ ]+).*/\1/p')
Step 5 – Configure the network interface
In our example our network interface is eth0. Our article will use eth0 but you have to use the network interface name from step 4.
Edit your network configuration.
sudo nano /etc/network/interfaces
Remove the following lines.
# The primary network interface allow-hotplug eth0 iface eth0 inet static address 126.96.36.199/24 gateway 188.8.131.52 # dns-* options are implemented by the resolvconf package, if installed dns-nameservers 184.108.40.206 220.127.116.11 dns-search snel.com
Configure the first VLAN 453.
auto eth0.453 iface eth0.453 inet static address 18.104.22.168 netmask 255.255.255.0 dns-nameservers 22.214.171.124 126.96.36.199 dns-search snel.com post-up ip route add 188.8.131.52/24 dev eth0.453 src 184.108.40.206 table firsttable post-up ip route add default via 220.127.116.11 dev eth0.453 table firsttable post-up ip rule add from 18.104.22.168/24 table firsttable post-up ip rule add to 22.214.171.124/24 table firsttable
Configure the second VLAN 3047.
auto eth0.3047 iface eth0.3047 inet static address 126.96.36.199 netmask 255.255.255.0 post-up ip route add 188.8.131.52/24 dev eth0.3047 src 184.108.40.206 table secondtable post-up ip route add default via 220.127.116.11 dev eth0.3047 table secondtable post-up ip rule add from 18.104.22.168/24 table secondtable post-up ip rule add to 22.214.171.124/24 table secondtable
Step 6 – Configure sysctl
Enable packet forwarding on the server by creating the following file.
sudo nano /etc/sysctl.d/90-override.conf
Add the following line.
Enable reverse path and arp filtering.
Apply the changes.
sudo sysctl -p /etc/sysctl.d/90-override.conf
Step 7 – Restart the server
Step 8 – Test IP addresses
Ping from your workstation to check if the IPs are active.
Step 9 – Test IP address on Server
Check if the packets are using the right VLAN to leave the server
Perform a ping from eth0.3047 to check if it’s using the right VLAN to communicate with the destination IP address.
ping -I eth0.3047 126.96.36.199
PING 188.8.131.52 (184.108.40.206) from 220.127.116.11 eth0.3047: 56(84) bytes of data. 64 bytes from 18.104.22.168: icmp_seq=1 ttl=122 time=2.03 ms 64 bytes from 22.214.171.124: icmp_seq=2 ttl=122 time=2.13 ms 64 bytes from 126.96.36.199: icmp_seq=3 ttl=122 time=2.21 ms 64 bytes from 188.8.131.52: icmp_seq=4 ttl=122 time=2.06 ms ^C --- 184.108.40.206 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3080ms rtt min/avg/max/mdev = 2.038/2.113/2.217/0.089 ms
Perform a ping from eth0.453
ping -I eth0.453 220.127.116.11
PING 18.104.22.168 (22.214.171.124) from 126.96.36.199 eth0.453: 56(84) bytes of data. 64 bytes from 188.8.131.52: icmp_seq=1 ttl=123 time=2.26 ms 64 bytes from 184.108.40.206: icmp_seq=2 ttl=123 time=2.37 ms 64 bytes from 220.127.116.11: icmp_seq=3 ttl=123 time=2.44 ms ^C --- 18.104.22.168 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2756ms rtt min/avg/max/mdev = 2.266/2.360/2.444/0.073 ms
Congratulations, you have now configured a server which listens to two VLANs with two gateways. VLAN tagging is not limited to two VLANs, multiple VLANs are supported. You have to add each VLAN according to the network configuration of that VLAN.
Can I use the same physical interface ETH0 to forward/route packages to the ISP from both vlans (VLAN 1 and VLAN 100)?
Yavuz Aydin says
With the correct hardware this is possible. Both the SW_VLAN_100 and MAIN_SWitch_VLAN1_and_VLAN100 should be a managed switch which supports 802.1Q VLAN Tagging and you should configure the MAIN_SWitch_VLAN1_and_VLAN100 and SW_VLAN_100 uplinks (tagged in both VLAN 1 and VLAN 100) correctly.