VLANs make it possible to separate large networks into smaller and manageable ones. The 802.1Q is a standard which is implemented by all vendors into their network equipment. Some switches have the ability to assign multiple VLANs to a single network port. With this feature, you can assign multiple VLANs to a single server. The switch can separate the packages because every Ethernet frame is tagged with the VLA
- The network switch your server is connected to must be set up for a successful procedure
- The switch should support VLAN tagging
- You must be logged in via SSH as sudo or root user. This tutorial assumes that you are logged in as a sudo user.
Step 1 – Log in using SSH
You must be logged in via SSH as sudo or root user. Please view this article for instructions if you don’t know how to connect.
Step 2 – Install dependency
sudo apt-get install vlan
Step 3 – Create network routes
Edit the following file in order to allow multiple VLANs on your server to create routing tables.
sudo nano /etc/iproute2/rt_tables
Add the following lines.
500 firsttable 501 secondtable
Step 4 – Find the active network interface
clear && echo $(ip -o -4 route get 18.104.22.168 | sed -nr 's/.*dev ([^\ ]+).*/\1/p')
Step 5 – Configure the network interface
In our example our network interface is eth0. Our article will use eth0 but you have to use the network interface name from step 4.
Edit your network configuration.
sudo nano /etc/network/interfaces
Remove the following lines.
# The primary network interface allow-hotplug eth0 iface eth0 inet static address 22.214.171.124/24 gateway 126.96.36.199 # dns-* options are implemented by the resolvconf package, if installed dns-nameservers 188.8.131.52 184.108.40.206 dns-search snel.com
Configure the first VLAN 453.
auto eth0.453 iface eth0.453 inet static address 220.127.116.11 netmask 255.255.255.0 dns-nameservers 18.104.22.168 22.214.171.124 dns-search snel.com post-up ip route add 126.96.36.199/24 dev eth0.453 src 188.8.131.52 table firsttable post-up ip route add default via 184.108.40.206 dev eth0.453 table firsttable post-up ip rule add from 220.127.116.11/24 table firsttable post-up ip rule add to 18.104.22.168/24 table firsttable
Configure the second VLAN 3047.
auto eth0.3047 iface eth0.3047 inet static address 22.214.171.124 netmask 255.255.255.0 post-up ip route add 126.96.36.199/24 dev eth0.3047 src 188.8.131.52 table secondtable post-up ip route add default via 184.108.40.206 dev eth0.3047 table secondtable post-up ip rule add from 220.127.116.11/24 table secondtable post-up ip rule add to 18.104.22.168/24 table secondtable
Step 6 – Configure sysctl
Enable packet forwarding on the server by creating the following file.
sudo nano /etc/sysctl.d/90-override.conf
Add the following line.
Enable reverse path and arp filtering.
Apply the changes.
sudo sysctl -p /etc/sysctl.d/90-override.conf
Step 7 – Restart the server
Step 8 – Test IP addresses
Ping from your workstation to check if the IPs are active.
Step 9 – Test IP address on Server
Check if the packets are using the right VLAN to leave the server
Perform a ping from eth0.3047 to check if it’s using the right VLAN to communicate with the destination IP address.
ping -I eth0.3047 22.214.171.124
PING 126.96.36.199 (188.8.131.52) from 184.108.40.206 eth0.3047: 56(84) bytes of data. 64 bytes from 220.127.116.11: icmp_seq=1 ttl=122 time=2.03 ms 64 bytes from 18.104.22.168: icmp_seq=2 ttl=122 time=2.13 ms 64 bytes from 22.214.171.124: icmp_seq=3 ttl=122 time=2.21 ms 64 bytes from 126.96.36.199: icmp_seq=4 ttl=122 time=2.06 ms ^C --- 188.8.131.52 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3080ms rtt min/avg/max/mdev = 2.038/2.113/2.217/0.089 ms
Perform a ping from eth0.453
ping -I eth0.453 184.108.40.206
PING 220.127.116.11 (18.104.22.168) from 22.214.171.124 eth0.453: 56(84) bytes of data. 64 bytes from 126.96.36.199: icmp_seq=1 ttl=123 time=2.26 ms 64 bytes from 188.8.131.52: icmp_seq=2 ttl=123 time=2.37 ms 64 bytes from 184.108.40.206: icmp_seq=3 ttl=123 time=2.44 ms ^C --- 220.127.116.11 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2756ms rtt min/avg/max/mdev = 2.266/2.360/2.444/0.073 ms
Congratulations, you have now configured a server which listens to two VLANs with two gateways. VLAN tagging is not limited to two VLANs, multiple VLANs are supported. You have to add each VLAN according to the network configuration of that VLAN.