CTs in different VLANs are able to communicate with each other

[dqq]

Hi,

I have following configuration:

- vmbr2 OVS bridge (attached image 1)
- Bridge ports: vlan01, vlan02

- vlan01 OVSIntPort (attached image 2)
- OVS Bridge: vmbr2
- VLAN Tag: 1
- IPv4/CIDR: 99.0.1.254/24

- vlan02 OVSIntPort (attached image 3)
- OVS Bridge: vmbr2
- VLAN Tag: 2
- IPv4/CIDR: 99.0.2.254/24


When I create 2 CTs and:
1) add CT1 to vlan01 (attached image 4)
2) add CT2 to vlan02 (attached image 5)

They are not able to ping themselves (as supposed), but when I add manually routes:
1) in CT1: ip route add 99.0.2.254/24 via 99.0.1.254
2) in CT2: ip route add 99.0.1.254/24 via 99.0.2.254

They are able to communicate with each other again.
With my understanding that should not be possible due to different VLAN tags set up in interfaces and OVSIntPorts.

1) Is there a way to avoid such a behaviour?
3) Is there any way for VM1 to still communicate with CT1 and CT2 but CT1 and CT2 not being able to communicate witch each other?

 

[dqq]

IT seems, that I have missed subforum - sould any mod move it to network configuration? Thanks

 

[Stoiko Ivanov]

Consider using regular linux bridges instead of OVS - takes one component out of the setup - which reduces complexity

is ip_forwarding enabled?

 

[dqq]

@Stoiko Ivanov - yes it is

Additionally, what I have found in OpenVswitch documentation ( I attach image)

Is it possible that this is the intended way of linux kernel and I have to use additional firewall?