Linux VLAN Tagging with ip link: 802.1Q Sub-Interfaces

Linux hosts connected to a switch trunk can carry multiple VLANs over one physical NIC by creating 802.1Q sub-interfaces with the ip command. Each sub-interface behaves like a normal Ethernet device to the network stack, but only frames tagged with its VLAN ID reach it. This is how hypervisors, routers-on-a-stick and firewall appliances segment traffic without extra hardware. This guide covers creating, addressing and persisting VLAN interfaces using iproute2 and the kernel 8021q module.

Create a VLAN Sub-Interface

# Create VLAN 100 on top of eth0
ip link add link eth0 name eth0.100 type vlan id 100
# Bring it up and assign an IP
ip link set eth0.100 up
ip addr add 10.100.0.1/24 dev eth0.100

The parent physical interface stays untagged (or carries whatever the trunk needs) and typically has no IP of its own when it is a pure trunk. The .100 suffix is only a naming convention — the VLAN ID comes from id 100, so names like eth0_100 or vlan100 work identically.

Multiple VLANs on One Trunk

ip link add link eth0 name eth0.100 type vlan id 100   # management
ip link add link eth0 name eth0.200 type vlan id 200   # production
ip link add link eth0 name eth0.300 type vlan id 300   # storage
ip link set eth0.100 up && ip addr add 10.100.0.1/24 dev eth0.100
ip link set eth0.200 up && ip addr add 10.200.0.1/24 dev eth0.200
ip link set eth0.300 up && ip addr add 10.300.0.1/24 dev eth0.300

Each VLAN now has its own broadcast domain, routing table entry and, if needed, firewall zone — exactly the segmentation a switch would provide for separate servers.

Verify the Configuration

ip -d link show eth0.100
ip link show eth0.100
cat /proc/net/vlan/eth0.100

ip -d link show prints vlan protocol 802.1Q id 100 <REORDER_HDR> confirming the tag; /proc/net/vlan/ exposes per-VLAN counters and device details for troubleshooting.

Persistence with systemd-networkd

Commands issued by hand disappear on reboot. With systemd-networkd, declare the VLAN in a .netdev file and address it in a .network file:

# /etc/systemd/systemd-networkd 20-eth0.100.netdev
[NetDev]
Name=eth0.100
Kind=vlan
[VLAN]
Id=100

# /etc/systemd/network/ 20-eth0.100.network
[Match]
Name=eth0.100
[Network]
Address=10.100.0.1/24

NetworkManager keeps VLANs in connection profiles (nmcli connection add type vlan ifname eth0.100 dev eth0 id 100), and Debian/Ubuntu ifupdown uses VLAN=yes plus a stanza in /etc/network/interfaces.

Troubleshooting

• No traffic on the sub-interface: the switch port must be a trunk allowing that VLAN; frames arrive tagged or the kernel drops them.
• Interface renamed: udev can auto-rename to rename1; add a matching udev rule or use a descriptive fixed name.
• Parent had an IP before: remove it — an IP on the untagged parent plus the same subnet on a VLAN sub-interface causes routing confusion.

VLAN sub-interfaces are the Linux half of a trunk; the switch half is covered in our Junos VLAN access/trunk examples and Huawei S5700 VLAN partition articles. For bonding multiple NICs under the trunk, see Linux network bonding configuration.

原文链接：https://kx.cloudingenium.com/en/vlan-configuration-linux-iproute2