Is it possible to put an LXC on VLAN 1?

[n8ur]

I am trying to configure an LXC with VLAN 1 and despite all efforts, I can neither ping to it from outside, or ping from it to outside. I changed the bridge-vids in /etc/network/interfaces from "2-4094" to "1-4094" but that made no difference.

Am I running up against a hard-coded configuration limitation?

Thanks!

 

[n8ur]

Apparently it's not possible. I found this thread via Google (it didn't turn up in the Proxmox forum search):

J

Thread 'Not possible to tag interface in VLAN 1'

May 12, 2016

Hello,

When I install the latest update of proxmox, my interface Tagged in VLAN 1 as removed of my hardware list

proxmox-ve: 4.2-48 (running kernel: 4.4.6-1-pve)
pve-manager: 4.2-2 (running version: 4.2-2/725d76f0)

I want to recreate this interface, it's not possible :

Parameter verification failed. (400)

net0: invalid format - unable to parse network options

and a modification in command line config file : xxx.conf not work

What can be done ?

Tanks

• jckubiaczyk
• Replies: 4
• Forum: Proxmox VE: Networking and Firewall

which pointed to: https://forum.proxmox.com/threads/not-possible-to-tag-interface-in-vlan-1.27363/
which says that VLAN1 can't be tagged in a container.

 

[cwt]

VLAN1 should never be used because it is not only the default PVID on linux bridges but also a „system reserved like“ default ID/PVID on many switches.

 

[n8ur]

Thanks @cwt. But is it the case that containers on VLAN 1 *won't work*, or just that it is bad practice? My reason for using VLAN 1 here is that the container runs a Unifi controller, and if the controller is not on the same VLAN as the router and switches, you have to jump through hoops to get them talking to each other.

 

[hevisko]

VLAN1 is *usually* the "default" when there are no 1Q tags, ie. untagged in most cases.

 

[cwt]

Thanks @cwt. But is it the case that containers on VLAN 1 *won't work*, or just that it is bad practice? My reason for using VLAN 1 here is that the container runs a Unifi controller, and if the controller is not on the same VLAN as the router and switches, you have to jump through hoops to get them talking to each other.

Both. It won’t work and it’s bad practice. Interconnecting VLANs can either be done on the switch (usually with no granular filter options or rules) or in your router (if supported). If you have no VLAN larger >1 defined in your network it’s not necessary to add a VLAN tag to your LXC. If you only have multiple subnets it’s the router‘s job to route between them and forward needed broadcast packets (for ap discovery or something like that).