Why enable vlan aware linux bridge if VMs assigned to vlans are already working

[apap]

I have VMs assigned to various vlans and they seem to work fine, with the "VLAN aware" switch in vmbr0 unchecked.

The OCD in me wants to turn it on (after all I have multiple vlans in the network) but I am concerned I will lock myself out of the proxmox server (I am not physically in the same place).

-----

 

[apap]

Looking at the wiki, if you don't enable "VLAN Aware" on the node (vmbr0), with vlan set on the guest eth cards, you would fall under this category, is that correct? (red box)

It implies that if you enable "VLAN Aware" on the node, you cannot use more than one VLAN on a single virtual NIC. Which virtual NIC is this, node's or VM's?

----------

 

[ph0x]

The virtual NICs are usually the VM ones.
Checking VLAN aware will not lock you out, it just makes it possible to put a VM into a VLAN without creating a dedicated bridge for the VLAN. If you forward a bridge with VLANs into a VM in total, you have to take care of that inside the VM.

 

[apap]

Thank you for the prompt response. This is precisely my puzzle.

I already have a VM running on a vlan just fine (it gets ip from the dhcp server and can see other devices on that vlan). All while the node's vmbr0 is NOT vlan aware and I don't have dedicated bridges for each vlan set-up in the node.

Why is vlan working in the guest when it shouldn't?

-----

This is the VM's network card:



-----

This is the node's Network interfaces (there are no vlan bridges setup (I don't know how to do this) and vmbr0 is not vlan aware):

 

[ph0x]

Well that's bullet no. 2 in your picture above. Proxmox probably generated another bridge for that vlan. You can check with ip link

 

[wbumiller]

For vlan aware bridges it is possible to directly configure the vlans for each port connected to the bridge. (Which vlan ids should pass through, which should get tagged/untagged along the way).
Without this setting, each vlan tag gets its vlan-bridge. This only works if the selected bridge is connected to something we recognize as its physical main port. A vlan device for that device is created, connected to the dedicated vlan bridge. Traffic within the bridge is untagged and only receives its tag once it crosses over to the physical network.

 

[ph0x]

Could you provide source on how to configure the bridge according to your first paragraph? For now I only know how to assign a tag via the GUI but would like to configure it more precisely.

 

[wbumiller]

The only other thing we currently semi-expose is the `trunks` option you can configure only via the command line (see the qm(1) and pct(1) man pages on how to use their 'set' subcommand), this corresponds to using `bridge vlan add dev <iface> vid <ids>`. Note that any custom changes you do manually via the bridge(8) command from iproute2 will not be persistent across restarts of the VMs or host.

 

[ph0x]

Thanks!