VLANs on the trunk
On the trunk, every frame carries an 802.1Q tag naming its VLAN. The switch (here, each lab host tagging its own frames) puts the tag on; the router reads it and hands the frame to the matching VLAN interface. That's how one cable carries three separate networks. Switching basics covers VLANs and trunks from the switch's side.
A capture on eth1 while a guest pings the router shows it: every frame is ethertype 802.1Q, vlan 20, and inside it is an ordinary IPv4 ping between 10.10.20.20 and 10.10.20.1. The replies leave tagged with VLAN 20 too.
Staff and guest machines can each reach their gateway. But notice the last test: the guest machine can also ping 10.10.10.1, the router's address on the staff VLAN. That's not forwarding between VLANs; it's the router answering on one of its own addresses, and Linux answers on any of its addresses from any interface. Keeping guests off the router itself is a job for the firewall's input chain, later in this lesson.
root@router:~# timeout 6 tcpdump -lnnei eth1 -c 4 icmp
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
21:59:16.402979 8a:1f:dc:85:2e:73 > 02:00:00:00:01:01, ethertype 802.1Q (0x8100), length 102: vlan 20, p 0, ethertype IPv4 (0x0800), 10.10.20.20 > 10.10.20.1: ICMP echo request, id 30105, seq 1, length 64
21:59:16.402987 02:00:00:00:01:01 > 8a:1f:dc:85:2e:73, ethertype 802.1Q (0x8100), length 102: vlan 20, p 0, ethertype IPv4 (0x0800), 10.10.20.1 > 10.10.20.20: ICMP echo reply, id 30105, seq 1, length 64
21:59:17.429123 8a:1f:dc:85:2e:73 > 02:00:00:00:01:01, ethertype 802.1Q (0x8100), length 102: vlan 20, p 0, ethertype IPv4 (0x0800), 10.10.20.20 > 10.10.20.1: ICMP echo request, id 30105, seq 2, length 64
21:59:17.429158 02:00:00:00:01:01 > 8a:1f:dc:85:2e:73, ethertype 802.1Q (0x8100), length 102: vlan 20, p 0, ethertype IPv4 (0x0800), 10.10.20.1 > 10.10.20.20: ICMP echo reply, id 30105, seq 2, length 64
4 packets captured
4 packets received by filter
0 packets dropped by kernel
root@staff:~# ip -br addr show eth0.10; ping -c 2 -W 1 10.10.10.1 | tail -2
eth0.10@eth0 UP 10.10.10.20/24
2 packets transmitted, 2 received, 0% packet loss, time 1045ms
rtt min/avg/max/mdev = 0.040/0.058/0.076/0.018 ms
root@guest:~# ping -c 2 -W 1 10.10.10.1 | tail -2
2 packets transmitted, 2 received, 0% packet loss, time 1019ms
rtt min/avg/max/mdev = 0.035/0.068/0.102/0.033 ms- Lines 4–7: Every frame on eth1 carries an 802.1Q tag, vlan 20. Inside is an ordinary ping between the guest and its gateway.
- Lines 12–15: A staff PC's own VLAN interface, eth0.10, and its gateway answering.
- Lines 17–19: A guest reaches the router's staff address too: the router answers on all its own addresses. The firewall's input chain deals with that.