VLANs
In the flat network, every broadcast reaches every device, and anyone can plug in anywhere and talk to anyone on the same subnet. VLANs (Virtual LANs) split one physical switch into several separate layer-2 networks. Each VLAN is its own broadcast domain, as if each had its own switch.
Each VLAN has a number from 1 to 4094. Here: VLAN 10 for staff PCs (pc1, pc2) and VLAN 20 for printers (pc3). Ports that connect to ordinary devices are access ports: they belong to exactly one VLAN, and the devices plugged into them have no idea VLANs exist. Their frames carry no VLAN information at all.
On the Linux switch, that's three steps: turn on VLAN filtering, take each access port out of the default VLAN 1, and put it in its VLAN as the PVID (port VLAN ID, the VLAN that untagged frames arriving on the port belong to) and untagged (frames leaving the port have no tag).
Then test again:
- pc1 pings pc2 (same VLAN) as before, but a capture on pc3 now sees nothing: VLAN 10's broadcasts stay in VLAN 10.
- Give pc3 an address in pc1's subnet, and it still can't reach pc1:
Destination Host Unreachable. Its ARP requests go nowhere near VLAN 10. VLANs separate devices at layer 2, regardless of what IP addresses they have.
That's the point of VLANs: separate groups (staff, printers, guests, phones, servers) share the same switches without sharing a broadcast domain, and anything between them has to go through a router, where you can apply policy.
# Turn on VLAN awareness, then make eth1-eth3 access ports: one untagged VLAN each, instead of the default VLAN 1.
ip link set br0 type bridge vlan_filtering 1
for port in eth1 eth2; do
bridge vlan del dev "$port" vid 1
bridge vlan add dev "$port" vid 10 pvid untagged
done
bridge vlan del dev eth3 vid 1
bridge vlan add dev eth3 vid 20 pvid untagged- Line 2: Make the bridge VLAN-aware.
- Lines 3–6: eth1 and eth2: out of VLAN 1, into VLAN 10 as their only, untagged VLAN.
- Lines 7–8: eth3: VLAN 20.
root@sw1:~# bridge vlan show
port vlan-id
eth1 10 PVID Egress Untagged
eth2 10 PVID Egress Untagged
eth3 20 PVID Egress Untagged
eth4 1 PVID Egress Untagged
br0 1 PVID Egress Untagged- Lines 3–4: Access ports for VLAN 10.
- Line 5: Access port for VLAN 20.
- Line 6: eth4 is still in the default VLAN 1 for now.
root@pc3:~# timeout 6 tcpdump -lnei eth0
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
0 packets captured
0 packets received by filter
0 packets dropped by kernel
root@pc3:~# ip -br addr show eth0
eth0@if13 UP 10.20.0.13/24 10.10.0.13/24
root@pc3:~# ping -c 2 10.10.0.11
PING 10.10.0.11 (10.10.0.11) 56(84) bytes of data.
From 10.10.0.13 icmp_seq=1 Destination Host Unreachable
From 10.10.0.13 icmp_seq=2 Destination Host Unreachable
--- 10.10.0.11 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1056ms
pipe 2- Lines 1–6: While pc1 pings pc2 (and ARPs first), pc3 hears nothing.
- Line 8: Even with an address in pc1's subnet…
- Lines 11–12: …pc3 can't reach pc1.
Check your understanding
pc3 has an address in 10.10.0.0/24, like pc1, but its port is in VLAN 20. Can they talk directly?
- No; different VLANs are separate layer-2 networks, so pc3's ARP requests never reach pc1
- Yes; same subnet means same network
- Only through a router
- Only if they're on the same switch