VLAN sub-interfaces — eth0.10, eth0.20, …

A VLAN sub-interface is a virtual interface that exists on top of a physical Ethernet interface. Each sub-interface corresponds to a VLAN ID; the physical interface carries all VLANs as tagged frames. This lesson covers how to create them in VyOS, how the kernel maps them to eth0.N device names, and the failure modes the operator must handle.

Creating a VLAN sub-interface

[edit]
vyos@vyos# set interfaces ethernet eth0 vif 10 address '192.0.2.1/24'
[edit]
vyos@vyos# set interfaces ethernet eth0 vif 10 description 'DATA'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

The vif 10 directive creates a sub-interface for VLAN 10. The address and description are attached to the sub-interface.

Multiple VLAN sub-interfaces

[edit]
vyos@vyos# set interfaces ethernet eth0 vif 10 address '192.0.2.1/24'
[edit]
vyos@vyos# set interfaces ethernet eth0 vif 10 description 'DATA'
[edit]
vyos@vyos# set interfaces ethernet eth0 vif 20 address '203.0.113.1/24'
[edit]
vyos@vyos# set interfaces ethernet eth0 vif 20 description 'VOICE'
[edit]
vyos@vyos# set interfaces ethernet eth0 vif 30 address '198.51.100.1/24'
[edit]
vyos@vyos# set interfaces ethernet eth0 vif 30 description 'MGMT'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

Each vif N creates a separate sub-interface. The parent eth0 carries all three VLANs as tagged frames.

Reading the kernel mapping

vyos@vyos:~$ ip link show
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
3: eth0.10@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
4: eth0.20@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
5: eth0.30@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff

The kernel shows the parent interface (eth0) and the children (eth0.10@eth0, eth0.20@eth0, eth0.30@eth0). The @eth0 indicates the parent.

MTU on the sub-interface

[edit]
vyos@vyos# set interfaces ethernet eth0 vif 10 mtu '1500'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

The MTU on the sub-interface must be at least 4 bytes less than the parent interface’s MTU (to account for the VLAN tag). For jumbo frames, configure the parent at 9004 and the sub-interfaces at 9000.

Firewall on the sub-interface

[edit]
vyos@vyos# set interfaces ethernet eth0 vif 10 firewall in name 'DATA-IN'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

Firewall rules apply per sub-interface, so each VLAN can have its own filtering.

How the result is validated

show interface ethernet eth0 vif 10
ip link show eth0.10
ip addr show eth0.10
tcpdump -i eth0 -e -n vlan 10

The first shows the VyOS view; the second shows the kernel mapping; the third shows the addresses; the fourth captures only VLAN 10 frames on the parent interface.

How it fails

The production failure modes the engineer must recognise:

• Sub-interface on a non-trunk port. The parent eth0 is connected to an access port on the switch. The sub-interface receives no traffic because the switch is not sending tagged frames.
• VLAN ID mismatch. The sub-interface is on VLAN 10 but the switch is sending VLAN 20. Frames arrive but on the wrong sub-interface.
• MTU mismatch. The parent has MTU 1500 and the sub-interfaces have MTU 9000. Frames from the sub-interface are larger than the parent can carry and are dropped.
• Missing firewall. A sub-interface with no firewall allows traffic from any source. Add firewall rules before commissioning.
• Native VLAN mismatch on the parent. The parent is configured with native VLAN 1 but the switch is sending native VLAN 999. Untagged frames are placed in different VLANs.

Rollback

The recovery from a bad VLAN sub-interface:

• Wrong VLAN: delete interfaces ethernet eth0 vif <wrong>; commit; save.
• Wrong address: delete interfaces ethernet eth0 vif 10 address '192.0.2.1/24'; set interfaces ethernet eth0 vif 10 address '192.0.2.5/24'; commit; save.
• MTU mismatch: reconfigure parent and sub-interfaces to match.

Production discipline

Cross-course references

The Proxmox course’s XXIX-Proxmox-Networking covers the host-side VLAN configuration. The OPNsense course’s XIV-OPNsense-VLAN covers the equivalent configuration on the firewall side. The Linux course’s XIX-Linux-NetFoundations covers the kernel’s VLAN model.

Quiz