VLAN security — VLAN hopping, native VLAN attacks, and the mitigations

VLANs are not a security boundary on their own. They separate broadcast domains but they do not prevent a determined attacker from crossing them. This lesson covers the attack patterns and the VyOS and switch mitigations every operator must apply.

VLAN hopping

sequenceDiagram
  participant Attacker as Attacker
  participant Switch as Switch
  participant Target as Target VLAN

  Attacker->>Switch: Frame, native VLAN, double-tagged
  Note over Switch: Switch strips native VLAN tag
  Switch->>Target: Frame with inner VLAN tag
  Target->>Attacker: Response (in target VLAN)
  Note over Attacker: Attacker is now on target VLAN

The attacker sends a double-tagged frame. The outer tag is the native VLAN (often VLAN 1, which the switch does not tag). The inner tag is the target VLAN. The switch strips the outer tag and forwards the frame on the target VLAN. The attacker has now reached the target VLAN.

Native VLAN attack

The native VLAN is the VLAN for untagged frames on a trunk. If the native VLAN is set to VLAN 1, an attacker can send untagged frames on VLAN 1. The switch treats them as control traffic and forwards them across the trunk.

[edit]
vyos@vyos# set interfaces ethernet eth0 native-vlan '999'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

Double tagging

The double-tagging attack uses a switch that does not check for inner tags. The attacker sends:

[Outer tag: native VLAN 1, untagged on trunk]
[Inner tag: target VLAN 20]
[Payload: target]

The switch strips the outer tag and forwards the inner-tagged frame on VLAN 20. The target VLAN receives the attacker’s packet.

Mitigations:

• Disable VLAN 1 on all trunks.
• Use BPDU guard to prevent rogue switches.
• Disable DTP (Dynamic Trunk Protocol) on access ports.

MAC flooding

The attacker floods the switch with random MAC addresses. The switch’s MAC table fills; the switch starts behaving like a hub and forwards all frames to all ports. The attacker can now sniff all VLAN traffic.

Mitigations:

• Port security on the switch (limit MAC addresses per port).
• 802.1X authentication.
• Storm control.

Rogue DHCP server

The attacker plugs into an access port and runs a rogue DHCP server. The DHCP server hands out addresses and a rogue default gateway, redirecting traffic through the attacker.

Mitigations:

• DHCP snooping on the switch.
• 802.1X authentication.
• VyOS DHCP server with explicit allow-list.

VyOS mitigations

# Change native VLAN
set interfaces ethernet eth0 native-vlan '999'

# Per-VLAN firewall
set interfaces ethernet eth0 vif 10 firewall in name 'VLAN10-IN'
set interfaces ethernet eth0 vif 20 firewall in name 'VLAN20-IN'

# Disable unused VLANs
set interfaces ethernet eth0 vif 999 description 'unused'

# MAC filter on sensitive VLANs
set interfaces ethernet eth0 vif 10 mac 'aa:bb:cc:dd:ee:ff'

Switch mitigations

The operator’s VyOS box is only half of the security boundary. The switch must also be hardened:

• Disable DTP on access ports.
• Disable VLAN 1 on all trunks.
• Enable BPDU guard.
• Enable port security (limit MAC per port).
• Enable DHCP snooping.
• Use 802.1X for port authentication.

Detecting an attack

vyos@vyos:~$ show log firewall | last 100

The firewall log shows dropped packets. A burst of drops from the same MAC address is a sign of an attack.

vyos@vyos:~$ tcpdump -i eth0 -e -n -c 1000 | sort | uniq -c | sort -rn | head

A high count of similar frames is a sign of MAC flooding.

How the result is validated

The security mitigations are validated by attempting the attacks against the box:

• Send a double-tagged frame; the VyOS box should drop it.
• Send untagged frames on the native VLAN; the switch should drop them.
• Flood the switch with MAC addresses; the switch should rate- limit or block.

How it fails

The security mitigations can fail:

• A switch without BPDU guard allows a rogue switch to negotiate trunk mode.
• A VyOS configuration without per-VLAN firewall allows VLAN 10 traffic to reach VLAN 20 unrestricted.
• A native VLAN left at VLAN 1 allows the most common attack.
• An access port with DTP enabled can be turned into a trunk by an attacker.

Rollback

The recovery from a VLAN security incident:

• Disconnect the attacker’s port.
• Investigate which VLANs were affected.
• Apply the missing mitigations.
• Audit the switch configuration.

Production discipline

Cross-course references

The OPNsense course’s XIV-OPNsense-VLAN covers the equivalent configuration on the firewall side. The Linux course’s XXII-Linux-NetTroubleshoot covers the underlying network security. The Observability course’s LXII-Observability-BusinessMetrics covers how to alert on VLAN changes.

Quiz