[SOLVED] How to enable tagged vlan1 for VM by default?

[cpw]

Hi
So I'm trying to replicate my current physical networking setup using a proxmox VM. Something I've encountered is that I seem to be unable to fully provision a VM with a completely tagged vlan trunk network (which would be necessary for my existing OPNsense solution, for example).

I have a vlan-aware bridge, and I can tag every vlan except vlan 1. To enable tagging of vlan 1, I have to run this command: bridge vlan add vid 1 dev tap101i0 once the virtual machine is up. This changes the bridge from this:

tap101i0          1 PVID Egress Untagged
                  2-4094

to this

tap101i0          1-4094

This fixes it and vlan1 is tagged and passed through to the VM correctly at that point.

I would like to automate doing this during VM startup, either with a script, configuration, or something similar. I know vlan 1 is supposed to be special, but I don't want to rejigger 15 years of network design to accommodate this bizarre restriction, and would rather actually just make it work the way it should.

 

[gurubert]

Use another VLAN ID as PVID for that bridge. We use 4063 for that purpose:

auto vmbr0
iface vmbr0 inet static
    bridge-ports bond0
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 1-3 5-99 101-4094
    bridge-pvid 4063

 

[cpw]

Use another VLAN ID as PVID for that bridge. We use 4063 for that purpose:

auto vmbr0
iface vmbr0 inet static
    bridge-ports bond0
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 1-3 5-99 101-4094
    bridge-pvid 4063

Ah, does it somehow inherit the PVID from the bridge configuration. I'll give that a try.

 

[cpw]

I gave that a try and it does not work for me, sadly. I added the pvid as you did, to a dummy vlan ID. The virtual machine networks were seemingly unaffected.

auto lo
iface lo inet loopback

iface enp3s0 inet
    bridge-vids 1-4094
    bridge-pvid 4090

auto vmbr0
iface vmbr0 inet manual
    bridge-ports enp3s0
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 1-4094
    bridge-pvid 4090

auto vmbr0.1
iface vmbr0.1 inet static
    address 10.10.0.5/24
    gateway 10.10.0.1

port              vlan-id 
enp3s0            1-4089
                  4090 PVID Egress Untagged
                  4091-4094
vmbr0             1
tap100i0          1 PVID Egress Untagged
                  2-4094
tap101i0          1-4094

 

[cpw]

This ended up bugging me late at night and I have figured out the magic configuration.

It seems to hear little relation to the clan configuration in the network interfaces file.

Rather, it is specified in the VM definition file, specifically there's some special tags you can apply to a network definition:

net0: virtio=BC:24:11:A7:D0:61,bridge=vmbr0,tag=4090,trunks=1-4094

After an hour perusing the perl code on GitHub, I figured out these two properties/tags:

tag is the PVID. It defaults to 1, but you can override it here. This will be marked as the egress untagged VLAN id.

trunks is a semicolon separated list of vlan ids to pass through to the interface with tags. 2-4094 is the default value here (pass all VLAN ids 2 to 4094 through).

To get what I wanted, I used the configuration above.

Hope this helps someone else who's been headscratching about this issue.