Help with management vlan

[juju01]

I have setup my management on vlan5 and eno1 port with the code below. The problem is, other vlans seem to be going through this as well. For instance, I am able to get vlan 20 to get an ip in the 20 subnet even if I use vmbr0. How can I restrict this to only vlan 5 ?

iface eno1.5 inet manual

auto vmbr0v5
iface vmbr0v5 inet static
        address  10.1.5.21/24
        gateway  10.1.5.1
        bridge-ports eno1.5
        bridge-stp off
        bridge-fd 0

auto vmbr0
iface vmbr0 inet manual
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0

 

[Dunuin]

Not sure but maybe something like this might help?

auto vmbr0
iface vmbr0 inet manual
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 5
        
auto vmbr0.5
iface vmbr0.5 inet manual
        address  10.1.5.21/24
        gateway  10.1.5.1

In that case only VMID 5 should be able allowed over that bridge.

 

[juju01]

Not sure but maybe something like this might help?

auto vmbr0
iface vmbr0 inet manual
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 5
       
auto vmbr0.5
iface vmbr0.5 inet manual
        address  10.1.5.21/24
        gateway  10.1.5.1

In that case only VMID 5 should be able allowed over that bridge.

no reference to bridge-ports eno1.5 and iface eno1.5 inet manual ?

 

[Dunuin]

no reference to bridge-ports eno1.5 and iface eno1.5 inet manual ?

In that case you don't need eno1.5. Eno1 will carry tagged and untagged packets. Because vmbr0 is set to "vlan aware" (bridge-vlan-aware yes) with only VMID5 allowed (bridge-vids 5) it can also carry untagged packets and packets tagged with VMID 5.
Then there is a linux VLAN interface "vmbr0.5" ontop of that bridge that will use VMID 5.

Edit:
Hm, but on second thought that might be problematic too if you want your management interface as much separated as possible from the guests.

What is your VLAN ID used for untagged traffic? Lets say your PVID would be 1 then you could try:

iface eno1 inet manual

iface eno1.1 inet manual

auto eno1.5
iface eno1.5 inet static
        address  10.1.5.21/24
        gateway  10.1.5.1

auto vmbr0
iface vmbr0 inet manual
        bridge-ports eno1.1
        bridge-stp off
        bridge-fd 0

Then guests attached to vmbr0 should only be able to use your PVID/VMID 1 used for untaggec traffic by your switch.