wiki:TipAndDoc/network/vlan

Version 5 (modified by mitty, 11 years ago) (diff)

--

  • VLAN ID 1 は多くのインテリジェントスイッチでマネージメント用に予約されているため、非推奨
  • mitty@vlan-gw:~$ sudo vconfig add eth1 1
    Added VLAN with VID == 1 to IF -:eth1:-
    WARNING:  VLAN 1 does not work with many switches,
    consider another number if you have problems.
    

Bridging VLAN

  • 概念図
  • 目的
    • vlan-gwのeth0にL2で抜けるルートがvlan-node上に欲しい
    • vlan-gwのeth0 <-> eth1で直接ブリッジするのは困る
      • vlan-nodeは本来NAPT下にある、など
    • VLANにすることで、NICを増やしたりすることなく複数サブネットを得る

make bridge on vlan-gw

  1. mitty@vlan-gw:~$ sudo vconfig add eth1 10
    Added VLAN with VID == 10 to IF -:eth1:-
    
    • mitty@vlan-gw:~$ ifconfig eth1.10
      eth1.10   Link encap:Ethernet  HWaddr 00:16:3e:3d:4f:ca
      
  2. mitty@vlan-gw:~$ sudo brctl addbr br-gw
  3. mitty@vlan-gw:~$ sudo brctl addif br-gw eth1.10
    • mitty@vlan-gw:~$ brctl show
      bridge name     bridge id               STP enabled     interfaces
      br-gw           8000.00163e3d4fca       no              eth1.10
      
    • mitty@vlan-gw:~$ ifconfig | grep addr
      br-gw     Link encap:Ethernet  HWaddr 00:16:3e:3d:4f:ca
      
      eth0      Link encap:Ethernet  HWaddr 00:16:3e:3d:4f:c9
                inet addr:192.168.0.185  Bcast:192.168.0.255  Mask:255.255.255.0
      
      eth1      Link encap:Ethernet  HWaddr 00:16:3e:3d:4f:ca
      
      eth1.10   Link encap:Ethernet  HWaddr 00:16:3e:3d:4f:ca
      
  4. mitty@vlan-gw:~$ sudo brctl addif br-gw eth0
    • このコマンドにより、eth0を通じて192.168.0.185でアクセスしている場合はいったん切断されるため、リモートから操作している場合などは注意
    • mitty@vlan-gw:~$ brctl show
      bridge name     bridge id               STP enabled     interfaces
      br-gw           8000.00163e3d4fc9       no              eth0
                                                              eth1.10
      
  5. mitty@vlan-gw:~$ sudo ifconfig eth0 0.0.0.0
  6. mitty@vlan-gw:~$ sudo ifconfig br-gw 192.168.0.185 netmask 255.255.255.0
  7. mitty@vlan-gw:~$ sudo ifconfig eth1.10 up
  8. mitty@vlan-gw:~$ sudo ifconfig br-gw up

add vlan nic on vlan-node

  1. mitty@vlan-node:~$ sudo vconfig add eth0 10
    Added VLAN with VID == 10 to IF -:eth0:-
    
  2. mitty@vlan-node:~$ sudo ifconfig eth0.10 192.168.0.13 netmask 255.255.255.0
    • 上流(192.168.0.0/24)にdhcpdがあるのであればdhclientなどを使うことも出来る
  3. mitty@vlan-node:~$ sudo ifconfig eth0.10 up
    • mitty@vlan-node:~$ ifconfig | grep addr
      eth0      Link encap:Ethernet  HWaddr 00:16:3e:d1:69:13
                inet addr:10.0.0.2  Bcast:10.255.255.255  Mask:255.0.0.0
      
      eth0.10   Link encap:Ethernet  HWaddr 00:16:3e:d1:69:13
                inet addr:192.168.0.13  Bcast:192.168.0.255  Mask:255.255.255.0
      
    • vlan-gw:eth1 <-> vlan-node:eth0 は10.0.0.0/8

check connection

  • mitty@vlan-node:~$ sudo tcpdump -i eth0.10
    04:35:02.147257 1c:c1:ww:xx:yy:zz > 00:16:3e:d1:69:13, ethertype IPv4 (0x0800), length 74: 192.168.0.102 > 192.168.0.13: ICMP echo request, id 1, seq 38, length 40
    04:35:02.147290 00:16:3e:d1:69:13 > 1c:c1:ww:xx:yy:zz, ethertype IPv4 (0x0800), length 74: 192.168.0.13 > 192.168.0.102: ICMP echo reply, id 1, seq 38, length 40
    04:35:03.149340 1c:c1:ww:xx:yy:zz > 00:16:3e:d1:69:13, ethertype IPv4 (0x0800), length 74: 192.168.0.102 > 192.168.0.13: ICMP echo request, id 1, seq 39, length 40
    04:35:03.149373 00:16:3e:d1:69:13 > 1c:c1:ww:xx:yy:zz, ethertype IPv4 (0x0800), length 74: 192.168.0.13 > 192.168.0.102: ICMP echo reply, id 1, seq 39, length 40
    
  • mitty@vlan-node:~$ sudo tcpdump -i eth0
    04:35:02.147257 1c:c1:ww:xx:yy:zz > 00:16:3e:d1:69:13, ethertype 802.1Q (0x8100), length 78: vlan 10, p 0, ethertype IPv4, 192.168.0.102 > 192.168.0.13: ICMP echo request, id 1, seq 38, length 40
    04:35:02.147293 00:16:3e:d1:69:13 > 1c:c1:ww:xx:yy:zz, ethertype 802.1Q (0x8100), length 78: vlan 10, p 0, ethertype IPv4, 192.168.0.13 > 192.168.0.102: ICMP echo reply, id 1, seq 38, length 40
    04:35:03.149340 1c:c1:ww:xx:yy:zz > 00:16:3e:d1:69:13, ethertype 802.1Q (0x8100), length 78: vlan 10, p 0, ethertype IPv4, 192.168.0.102 > 192.168.0.13: ICMP echo request, id 1, seq 39, length 40
    04:35:03.149376 00:16:3e:d1:69:13 > 1c:c1:ww:xx:yy:zz, ethertype 802.1Q (0x8100), length 78: vlan 10, p 0, ethertype IPv4, 192.168.0.13 > 192.168.0.102: ICMP echo reply, id 1, seq 39, length 40
    
    04:35:11.744387 00:16:3e:3d:4f:ca > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 10.0.0.2 tell 10.0.0.1, length 28
    04:35:11.744428 00:16:3e:d1:69:13 > 00:16:3e:3d:4f:ca, ethertype ARP (0x0806), length 42: Reply 10.0.0.2 is-at 00:16:3e:d1:69:13, length 28
    04:35:11.744471 00:16:3e:3d:4f:ca > 00:16:3e:d1:69:13, ethertype IPv4 (0x0800), length 98: 10.0.0.1 > 10.0.0.2: ICMP echo request, id 1165, seq 1, length 64
    04:35:11.744489 00:16:3e:d1:69:13 > 00:16:3e:3d:4f:ca, ethertype IPv4 (0x0800), length 98: 10.0.0.2 > 10.0.0.1: ICMP echo reply, id 1165, seq 1, length 64
    04:35:12.744806 00:16:3e:3d:4f:ca > 00:16:3e:d1:69:13, ethertype IPv4 (0x0800), length 98: 10.0.0.1 > 10.0.0.2: ICMP echo request, id 1165, seq 2, length 64
    04:35:12.744831 00:16:3e:d1:69:13 > 00:16:3e:3d:4f:ca, ethertype IPv4 (0x0800), length 98: 10.0.0.2 > 10.0.0.1: ICMP echo reply, id 1165, seq 2, length 64
    

dhcp on VLAN

  • mitty@vlan-node:~$ cat /etc/network/interfaces
    auto lo
    iface lo inet loopback
    
    auto eth0
    iface eth0 inet dhcp
    
    auto vlan10
    iface vlan10 inet dhcp
    	vlan-raw-device eth0
    
  • mitty@vlan-node:~$ ifconfig | grep addr
    eth0      Link encap:Ethernet  HWaddr 00:16:3e:d1:69:13
    
    vlan10    Link encap:Ethernet  HWaddr 00:16:3e:d1:69:13
              inet addr:192.168.0.199  Bcast:192.168.0.255  Mask:255.255.255.0
    
    • eth0側にはIPが割り振られていない(期待通り)
    • vlan10とeth0.10は同じ -> man 5 vlan-interfaces
  • mitty@vlan-node:~$ sudo tcpdump -i eth0
    ...
    
    05:01:18.183019 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    05:01:28.750340 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    05:01:43.031794 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    
    05:02:02.942903 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 346: vlan 10, p 0, ethertype IPv4, 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    05:02:02.944507 00:24:wx:yz:wx:yz > 00:16:3e:d1:69:13, ethertype 802.1Q (0x8100), length 354: vlan 10, p 0, ethertype IPv4, 192.168.0.1.67 > 192.168.0.199.68: BOOTP/DHCP, Reply, length 308
    05:02:02.944977 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 346: vlan 10, p 0, ethertype IPv4, 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    05:02:02.947171 00:24:wx:yz:wx:yz > 00:16:3e:d1:69:13, ethertype 802.1Q (0x8100), length 365: vlan 10, p 0, ethertype IPv4, 192.168.0.1.67 > 192.168.0.199.68: BOOTP/DHCP, Reply, length 319
    05:02:03.125276 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 10, p 0, ethertype ARP, Request who-has 192.168.0.1 tell 192.168.0.199, length 28
    05:02:03.125419 00:24:wx:yz:wx:yz > 00:16:3e:d1:69:13, ethertype 802.1Q (0x8100), length 64: vlan 10, p 0, ethertype ARP, Reply 192.168.0.1 is-at 00:24:wx:yz:wx:yz, length 46
    
    05:02:22.984115 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 10, p 0, ethertype ARP, Request who-has 192.168.0.199 tell 192.168.0.102, length 46
    05:02:22.984148 00:16:3e:d1:69:13 > 1c:c1:zz:yy:xx:ww, ethertype 802.1Q (0x8100), length 46: vlan 10, p 0, ethertype ARP, Reply 192.168.0.199 is-at 00:16:3e:d1:69:13, length 28
    05:02:22.984242 1c:c1:zz:yy:xx:ww > 00:16:3e:d1:69:13, ethertype 802.1Q (0x8100), length 78: vlan 10, p 0, ethertype IPv4, 192.168.0.102 > 192.168.0.199: ICMP echo request, id 1, seq 42, length 40
    05:02:22.984275 00:16:3e:d1:69:13 > 1c:c1:zz:yy:xx:ww, ethertype 802.1Q (0x8100), length 78: vlan 10, p 0, ethertype IPv4, 192.168.0.199 > 192.168.0.102: ICMP echo reply, id 1, seq 42, length 40
    05:02:23.986581 1c:c1:zz:yy:xx:ww > 00:16:3e:d1:69:13, ethertype 802.1Q (0x8100), length 78: vlan 10, p 0, ethertype IPv4, 192.168.0.102 > 192.168.0.199: ICMP echo request, id 1, seq 43, length 40
    05:02:23.986609 00:16:3e:d1:69:13 > 1c:c1:zz:yy:xx:ww, ethertype 802.1Q (0x8100), length 78: vlan 10, p 0, ethertype IPv4, 192.168.0.199 > 192.168.0.102: ICMP echo reply, id 1, seq 43, length 40
    
  • mitty@vlan-gw:~$ sudo tcpdump -i eth1
    04:57:01.612502 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    04:57:04.284819 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    04:57:12.426705 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    
    ...
    
    05:01:18.183048 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    05:01:28.750367 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    05:01:43.031819 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    
    05:02:02.942934 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 346: vlan 10, p 0, ethertype IPv4, 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    05:02:02.944491 00:24:wx:yz:wx:yz > 00:16:3e:d1:69:13, ethertype 802.1Q (0x8100), length 354: vlan 10, p 0, ethertype IPv4, 192.168.0.1.67 > 192.168.0.199.68: BOOTP/DHCP, Reply, length 308
    05:02:02.945004 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 346: vlan 10, p 0, ethertype IPv4, 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    05:02:02.947157 00:24:wx:yz:wx:yz > 00:16:3e:d1:69:13, ethertype 802.1Q (0x8100), length 365: vlan 10, p 0, ethertype IPv4, 192.168.0.1.67 > 192.168.0.199.68: BOOTP/DHCP, Reply, length 319
    05:02:03.125309 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 10, p 0, ethertype ARP, Request who-has 192.168.0.1 tell 192.168.0.199, length 28
    05:02:03.125410 00:24:wx:yz:wx:yz > 00:16:3e:d1:69:13, ethertype 802.1Q (0x8100), length 64: vlan 10, p 0, ethertype ARP, Reply 192.168.0.1 is-at 00:24:wx:yz:wx:yz, length 46
    
  • 起動時、eth0側のdhcpタイムアウト待ちをするため、vlan10にIPが振ってくるまで2分ほど遅延する
    • vlan-node:/etc/network/interfaces
      iface eth0 inet manual
      
    • などにするとよい

dhcpd on another network

  • 概念図
    • vlan-gw:eth1 <-> vlan-node:eth0 に192.168.1110/24でdhcpdを建てる
    • mitty@vlan-gw:~$ sudo ifconfig eth1.10 down
  • mitty@vlan-node:~$ cat /etc/network/interfaces
    auto lo
    iface lo inet loopback
    
    auto eth0
    iface eth0 inet dhcp
    
    auto vlan10
    iface vlan10 inet dhcp
    	vlan-raw-device eth0
    
  • mitty@vlan-node:~$ ifconfig | grep addr
    eth0      Link encap:Ethernet  HWaddr 00:16:3e:d1:69:13
              inet addr:192.168.111.102  Bcast:192.168.111.255  Mask:255.255.255.0
    
    vlan10    Link encap:Ethernet  HWaddr 00:16:3e:d1:69:13
    
    • vlan-node:vlan10にはdhcpでIPが割り振られることはない(期待通り)
  • mitty@vlan-gw:~$ sudo ifconfig eth1.10 up
  • mitty@vlan-node:~$ ifconfig
    eth0      Link encap:Ethernet  HWaddr 00:16:3e:d1:69:13
              inet addr:192.168.111.102  Bcast:192.168.111.255  Mask:255.255.255.0
    
    vlan10    Link encap:Ethernet  HWaddr 00:16:3e:d1:69:13
              inet addr:192.168.0.199  Bcast:192.168.0.255  Mask:255.255.255.0
    
  • mitty@vlan-node:~$ sudo tcpdump -i eth0
    10:03:25.576221 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    10:03:26.577102 00:1b:zz:yy:xx:ww > 00:16:3e:d1:69:13, ethertype IPv4 (0x0800), length 342: 192.168.111.1.67 > 192.168.111.102.68: BOOTP/DHCP, Reply, length 300
    10:03:26.577404 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    10:03:26.702221 00:1b:zz:yy:xx:ww > 00:16:3e:d1:69:13, ethertype IPv4 (0x0800), length 342: 192.168.111.1.67 > 192.168.111.102.68: BOOTP/DHCP, Reply, length 300
    
    10:03:26.940715 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 346: vlan 10, p 0, ethertype IPv4, 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    10:03:26.941123 00:1b:zz:yy:xx:ww > 00:16:3e:d1:69:13, ethertype IPv4 (0x0800), length 342: 192.168.111.1.67 > 192.168.111.102.68: BOOTP/DHCP, Reply, length 300
    10:03:26.942027 00:24:wx:yz:wx:yz > 00:16:3e:d1:69:13, ethertype 802.1Q (0x8100), length 354: vlan 10, p 0, ethertype IPv4, 192.168.0.1.67 > 192.168.0.199.68: BOOTP/DHCP, Reply, length 308
    10:03:26.942392 00:16:3e:d1:69:13 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 346: vlan 10, p 0, ethertype IPv4, 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:3e:d1:69:13, length 300
    10:03:26.942676 00:1b:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 192.168.111.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 300
    10:03:26.944592 00:24:wx:yz:wx:yz > 00:16:3e:d1:69:13, ethertype 802.1Q (0x8100), length 365: vlan 10, p 0, ethertype IPv4, 192.168.0.1.67 > 192.168.0.199.68: BOOTP/DHCP, Reply, length 319
    

VLAN with VMware Workstation on Windows

  • WindowsはOSとしてはtag VLANに対応して居ない
  • vmware workstation は VLAN 非対応

    ホストOSで、Tag VLANを切って、その上で、vmware が対応するタグVLAN I/F をゲストOSに割り当てればよい。そういう意味では、ゲストOSからはTag VLANではなくて別インターフェースになる。 使いにくいといえば使いにくい。特にWindowsホストOSの場合はWindows自体がTag VLAN に対応していないのでめんどう。Ethernetカード専用のドライバでの対応になる。

  • VMware Communities: Windows 7/vista and VLAN Tagging...
  • Windowsホスト上にVMware WorkstationでLinuxゲストを作り、仮想NICをブリッジしてVLAN deviceを作成しても、うまく疎通出来ない
  • mitty@vmware:~$ ifconfig -a | grep addr
    eth0      Link encap:Ethernet  HWaddr 00:0c:29:4b:23:a8
              inet addr:192.168.111.103  Bcast:192.168.111.255  Mask:255.255.255.0
    
  1. mitty@vmware:~$ sudo modprobe 8021q
  2. mitty@vmware:~$ sudo vconfig add eth0 10
    Added VLAN with VID == 10 to IF -:eth0:-
    
  3. mitty@vmware:~$ sudo ifconfig eth0.10 up
  4. mitty@vmware:~$ sudo dhclient eth0.10
  • mitty@vmware:~$ sudo tcpdump -i eth0
    12:19:40.630473 00:0c:29:4b:23:a8 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 346: vlan 10, p 0, ethertype IPv4, 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:0c:29:4b:23:a8, length 300
    12:19:40.632184 00:1b:zz:yy:xx:ww > 00:0c:29:4b:23:a8, ethertype IPv4 (0x0800), length 342: 192.168.111.1.67 > 192.168.111.103.68: BOOTP/DHCP, Reply, length 300
    12:19:40.633118 00:24:wx:yz:wx:yz > 00:0c:29:4b:23:a8, ethertype IPv4 (0x0800), length 386: 192.168.0.161.1 > 192.168.0.180.68: BOOTP/DHCP, Reply, length 344
    12:19:43.020357 00:0c:29:4b:23:a8 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 346: vlan 10, p 0, ethertype IPv4, 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:0c:29:4b:23:a8, length 300
    12:19:43.021589 00:1b:zz:yy:xx:ww > 00:0c:29:4b:23:a8, ethertype IPv4 (0x0800), length 342: 192.168.111.1.67 > 192.168.111.103.68: BOOTP/DHCP, Reply, length 300
    12:19:43.022460 00:24:wx:yz:wx:yz > 00:0c:29:4b:23:a8, ethertype IPv4 (0x0800), length 386: 192.168.0.161.1 > 192.168.0.180.68: BOOTP/DHCP, Reply, length 344
    
    • requestはVLAN ID 10となっているが、replyはVLAN IDが無くなってしまっている
  • mitty@vmware:~$ ifconfig -a | grep addr
    eth0      Link encap:Ethernet  HWaddr 00:0c:29:4b:23:a8
              inet addr:192.168.111.103  Bcast:192.168.111.255  Mask:255.255.255.0
    
    eth0.10   Link encap:Ethernet  HWaddr 00:0c:29:4b:23:a8
    

Attachments (2)

Download all attachments as: .zip