VLANs need to have IP addresses?

Joined
Jul 2, 2019
Messages
648
Hi folks - I think that I have VLANs figured out on a test setup (only one NIC, and it is a Realtek). If I add an IP address to the VLAN when I create it, the jail assigned to that VLAN seems to work fine. Note: this is with 11.3 RC1.

I am setting up a jail using:
  • VNET
  • Berkeley Packet Filter
  • IPv4 Interface: vnet0
  • IPv4 Address: 192.168.25.121
  • IPv4 Netmask: 24
  • IPv4 Default Router: 192.168.25.254
  • Interface: vnet0:bridge25 (I am matching my bridges to the VLAN)
  • vnet_default_interface: vlan25
VLAN configuration:
  • VLAN Name: vlan25
  • Parent Interface: re0
  • NO DHCP
  • VLAN Tag: 25
  • Options: UP
  • IP Address: 192.168.25.122
Note: I have my UniFi Switch 24 set so the port that this box is connecting with Native VLAN set to vlan20 (that is my server vlan, 192.168.20.0/24), with vlan25 (192.168.25.0/24) as tagged.

Question: Is this the way that VLANs are supposed to work in FreeNAS (FreeBSD)? That is, the VLAN itself needs to have an IP address?
 

jgreco

Resident Grinch
Joined
May 29, 2011
Messages
18,680
That's kinda like saying your ethernet cable needs an IP address. It makes little to no sense.

A virtual LAN is a way for your switchgear to handle multiple broadcast domains and control frame ingress and egress. Internally, virtually every modern switch silicon supports the concept of vlan's, except perhaps the cheapest of the cheap cheap.

The terminology vendors use can sometimes be atrocious and it isn't always clear what's meant. "Native VLAN?" There's no such thing (and I'm calling it out because it's an oft-used stupid term that is confusing, it's like calling your residential NAT gateway a "router").

Your switch internally deals with tagged frames. Tags are the essential thing used to create networks on your switch. Every frame has a tag.

A frame enters the switch. During ingress, one of several things can happen.

1) If the frame lacks a tag, i.e. coming from a device that doesn't have VLAN's configured, one of two things:
1a) the switch MUST add a tag. This could be the default tag, usually "vlan 1". The assigned tag is called the PVID. Each port can have a different PVID.​
1b) the switch could also reject the frame, dropping it. This might happen where a port is marked for tagged traffic only.​
2) If the frame has a tag, i.e. coming from a VLAN-configured device:
2a) the switch accepts the frame as-is​
2b) Or the switch could also reject the frame, dropping it. This might happen where a port isn't allowed access to a vlan.​
For egress, you have a simple list of port memberships. Each port can emit frames for VLAN's that it is a member of. This can be either tagged or untagged. Untagged memberships should be limited to one for each port, and should also match the PVID, unless you have special magic sorcery reasons. Which do exist.

Now, your switch may very well hide a lot of this crapola. And it *is* crapola. But it is also how the sausage is made.

There is nothing magic about a VLAN. It is a virtualized LAN. It is nothing more. It requires no IP address. It does require proper configuration to have a chance of working properly. The beautiful thing about VLAN's is that you can sit at your desk and design and implement your network without running new cabling. You can also run a bunch of VLAN's over a single cable.



So on the FreeBSD side, it's much the same.

You do need to do some configuration to cause a VLAN to work. You need an uplink port, let's call it "em0".

For "em0" you want to configure it only as "up".

Then you want to create a vlan on top of it. Or ten. Or a hundred. Doesn't matter too much.

For each vlan you configure, most of the normal ifconfig stuff you could do (configure IPv4, v6, bridges, etc). is available to you.

You can absolutely create a vlan that is simply marked "up" and then attach a bridge to it. This sounds like what you're trying to do. I've done it, for years, works fine. The FreeBSD vlan* interface is created on the fly and is a virtual (as opposed to a physical) device that performs communications on the physical parent device.

The question is whether it will get configured correctly if you do it via the FreeNAS GUI. That, I don't know.
 
Joined
Jul 2, 2019
Messages
648
That's kinda like saying your ethernet cable needs an IP address. It makes little to no sense.
That's what I thought! I wonder why the option to put an IP address on the VLAN actually exists as an option...

I'm going to mess with this somemore... Maybe after my 30 years in IT, this dog is getting too old :confused:
 

jgreco

Resident Grinch
Joined
May 29, 2011
Messages
18,680
That's what I thought! I wonder why the option to put an IP address on the VLAN actually exists as an option...

Well, because you *can* and often *do*. For example, many of the FreeNAS units I work with have access to multiple networks and it is often easier just to put an interface directly on the VLAN's that need it. But having only two physical interfaces, the best way to do that is to set up LACP failover on the two physical interfaces (connected to two different switches for high availability), then use the lagg0 interface as the parent for the vlans, and then do all your IP configuration foo on the vlanX interfaces - two virtual networking layers deep.

Your question is do you HAVE to have an IP. That answer is a resounding no. But you often DO have an IP address.
 
Joined
Jul 2, 2019
Messages
648
Never thought about doing it that way. That said, at work I have SMEs who know the grimy details. (Nothing like a good team!)

Is there any step-by-step guide to setting up VLANs with jails? I think that by now I have tried all the combinations and permutations but I still can't get it to work...
 
Joined
Jul 2, 2019
Messages
648
Hmmm... I just created another jail on the same VLAN subnet and they can see each other. Not sure if this mean anything, though... :-(
 
Joined
Jul 2, 2019
Messages
648
Okay - another thought: I already have a jail (with VNET/Berkeley Packet Filter - 192.168.30.252) on the physical interface (igb3) that is connected to the UniFi switch (native VLAN 30 for the 192.168.30.0/24 subnet). I then added the FreeNAS VLAN 101 (for the 192.168.101.0/24 subnet) and assigned the Parent Interface to igb3. VLAN 101 is tagged on the UniFi switchport (e.g., VLAN 30 is the native VLAN and VLAN 101 is tagged).

Would this make any difference?

TIA!
 
Joined
Jul 2, 2019
Messages
648
On final thought: My X9DR3-LN4F+ uses the Intel I350 for the GigE connections. There was a bug on VLAN problems reported for FreeBSD (and also pfSense).

Was this fixed in FreeNAS 11.2?
 
Top