thx for not giving up on me
This is due to the architecture of the FreeBSD network implementation
also, apply to SCALE, as it is Debian based?
I read
Routing and Firewalling VLANS with FreeBSD | Klara Inc and
FreeBSD jails with VNET and NAT · boucek.me, as VNET is any FreeBSD thing I'm not sure if applies to SCALE as well. May they keep things similar in the foreground between CORE and SCALE.
I know
Linux Virtualization, Chroot Jail but I cannot find an equivalent to VNET
In FreeBSD as with many routers (not switches!) a VLAN interface is a routed subinterface. You can create e.g. VLAN 5 on igb0 and VLAN 5 on igb1 but that does not imply that these two interfaces are in any way connected.
that is clear, the connection between VLAN 5 and 1 is routing --> Router
If you want to turn FreeBSD into a software switch you need to create a bridge interface with these two VLAN interfaces as members.
so the bridge does routing? Seems possible if I read
Chapter 33. Advanced Networking | FreeBSD Documentation Portal
I would expect that only if, in our case, VLAN 1 and 5 are in the broadcast domain, the communication would work.
So adding a bridge upstream VLAN interfaces enable or include the routing capabilities of FreeBSD?
That is how I understand your configuration
Code:
------------------------------------------------------
| eth0 eth1 TrueNAS SCALE |
| || || |
| ----------bond0----------- |
| || |
| bridge1 |
| |------||------------------| |
| | |-----| | |
| VLAN1----------VLAN2---------VLAN3 |
| | | | |
| bridge1 bridge2 bridge3 |
| |
------------------------------------------------------
If the TrueNAS system itself needs to communicate in that bridge network, the IP address goes on the bridge interface and not the individual members. Like with your switch you put the IP address on the VLAN (virtual) interface and not the individual switched ports.
there is where it drives you nuts as a port is an Ethernet Interface as well :) but a port of the Bridge

. The VLAN interface is your gate to L3 (on my MikroTik Router but only if I allow the VLAN to leave the bridge by allowing it to flow through the mysterious Bridge CPU Port).
And there is still
If you bridge a VLAN interface it becomes a strictly layer 2 interface. The layer 3 function moves up to the parent, because all bridge members share the same layer 3 ... If there is no bridge in place, you are correct. The VLAN interface is a layer 3 interface in that case.
Reading posts in the TrueCharts Discord, it is the bridge that gives access to the host, TrueNAS System or does it only apply to the setup above?
Otherwise, NIC->VLAN interface (without IP)->VM (single Docker container) would be real isolation as the bridge would still allow L2 access, regardless if it has an IP or not.
(on my router it is a bit different, with VLAN, even L2 communication is only possible if a VLAN interface is added, without IP config. That the Access Port is only a Member Port of the VLAN aware Bridge is not enough. I have tested that this morning).
all I want to achieve in the end is to extend my
router on a stick topology to the application on my TrueNAS
I hope my understanding is correct, that VLAN binding is possible with docker as it allows interface assignment unlike Kubernetes (TN Apps).
Code:
www
|
|
------------------------------
| ROUTER |
| FIREWALL, VLAN-GATEWAYS |
------------------------------
||
||VLAN-TRUNK
||
------------------------------
| SWITCH, VLAN CAPABLE |
| only L2 operation |=== OTHER DEVICES such as APs
------------------------------
|| ||
|| TAGGED TRAFFIC ONLY ||
|| ||
------------------------------------------------------
| eth0 eth1 TrueNAS SCALE |
| || || |
| ----------bond0----------- |
| || |
| VLAN1----------VLAN2---------VLAN3 |
| | | | |
| bridge1 bridge2 bridge3 |
| |-VM |-Docker |-VM |-Docker |-VM |-Docker |
| |
------------------------------------------------------
(I'm aware of TrueChart's MetalLB and Docker-Compose but it is not said, if interface assignment in Docker-Compose allows real isolation)