Connect some VMs with untagged and some tagged VLANs

[yakatz]

We have tons of VLANs available on our servers. Most VMs are connected to a single VLAN and we created multiple bridges for that, but there are a few VMs that we would like to pass all traffic to and do the tagging in the VM.

root@srv00:~# cat /etc/network/interfaces
# network interface settings; autogenerated
# Please do NOT modify this file directly, unless you know what
# you're doing.
#
# If you want to manage parts of the network configuration manually,
# please utilize the 'source' or 'source-directory' directives to do
# so.
# PVE will preserve these directives, but will NOT read its network
# configuration from sourced files, so do not attempt to move any of
# the PVE managed interfaces into external files!

auto lo
iface lo inet loopback

iface idrac inet manual

auto eno1
iface eno1 inet manual

auto eno2
iface eno2 inet manual

auto bond0
iface bond0 inet manual
        bond-slaves eno1 eno2
        bond-miimon 100
        bond-mode 802.3ad
        bond-xmit-hash-policy layer2+3

auto bond0.2514
iface bond0.2514 inet manual

auto vmbr2514
iface vmbr2514 inet static
        address 10.72.14.207/24
        gateway 10.72.14.1
        bridge-ports bond0.2514
        bridge-stp off
        bridge-fd 0

auto vmbr0
iface vmbr0 inet manual
        bridge-ports bond0
        bridge-stp off
        bridge-fd 0

auto vmbr884
iface vmbr884 inet static
        address 10.88.4.2/24
        bridge-ports bond0.884
        bridge-stp off
        bridge-fd 0
#proxmox traffic

auto vmbr885
iface vmbr885 inet static
        address 10.88.5.2/24
        bridge-ports bond0.885
        bridge-stp off
        bridge-fd 0
#ceph traffic

auto vmbr886
iface vmbr886 inet static
        address 10.88.6.2/24
        bridge-ports bond0.886
        bridge-stp off
        bridge-fd 0
#ceph osd traffic

It seems like not all tagged traffic is actually making it to the VMs on vmbr0 - for example, if I set the interface in proxmox to be virtio=XX:XX:XX:XX:XX:XX,bridge=vmbr0,tag=441, the guest is able to see traffic on that VLAN (using tcpdump), but if I set the interface to be virtio=XX:XX:XX:XX:XX:XX,bridge=vmbr0, traffic for some other VLANs shows up, but not that VLAN.

How can I make every VLAN accessible on vmbr0?

 

[gurubert]

Configure the bridge vmbr0 as VLAN-aware. Then it should be able to pass tagged VLAN packets.

 

[yakatz]

I finally got back to this - it doesn't seem to be working properly.

I configured a network interface on a vm connected to vmbr0.


From that machine, I can't ping the gateway. When I run tcpdump on the host, I can see ARP requests and responses, but the ARP response never gets back to the guest.

tcpdump on the host:


Host network config:


Ping on the guest:


If I change the interface in proxmox to be tagged and in the VM to be untagged, it works.
The reason I want to do this is I have a network monitoring application that is VLAN aware, so I want the VLANs to all be accessible.