Open vSwitch Basics: Bridges, Access Ports and VLANs

Open vSwitch (OVS) is the production-grade virtual switch behind most cloud platforms: it forwards frames in the kernel datapath, speaks OpenFlow, and exposes a configuration database you manage with ovs-vsctl. The OVS port model mirrors a physical switch — ports on a bridge are either trunks (pass tagged 802.1Q traffic) or access ports assigned one untagged VLAN. This guide creates a bridge, wires up access and trunk ports, adds a GRE tunnel port, and verifies the result.

Bridge and Port Model

$ ovs-vsctl add-br br0
$ ovs-vsctl add-port br0 eth0            # trunk port (default)
$ ovs-vsctl add-port br0 tap0 tag=9      # access port for VLAN 9

A port added without tag= is a trunk that passes any 802.1Q-tagged VLAN. Adding tag=N makes it an access port on VLAN N — frames egress untagged. Change an existing port the same way:

$ ovs-vsctl set port tap0 tag=9

Internal Ports with IP Addresses

To give the bridge itself an IP (the gateway for VMs), add an internal port — the OVS equivalent of a switch SVI:

$ ovs-vsctl add-port br0 vlan10 tag=10 -- set Interface vlan10 type=internal
$ ip addr add 192.168.0.123/24 dev vlan10
$ ip link set vlan10 up

Tunnel Ports: Extending L2 over IP

OVS can stretch a bridge across hosts with GRE or VXLAN tunnel ports — the datapath encapsulates and the remote bridge appears directly connected:

$ ovs-vsctl add-port br0 gre0 -- set Interface gre0 type=gre     options:remote_ip=1.2.3.4

For VXLAN (the modern choice for multi-tenant fabrics) use type=vxlan options:remote_ip=... options:key=100.

Port Mirroring (SPAN)

Mirror all traffic on eth0/tap0 to a monitor port tap1 for troubleshooting:

$ ovs-vsctl add-port br0 tap1     -- --id=@p get port tap1     -- --id=@m create mirror name=m0 select-all=true output-port=@p     -- set bridge br0 mirrors=@m

$ ovs-vsctl clear bridge br0 mirrors      # disable mirroring

Verifying the Configuration

$ ovs-vsctl show
$ ovs-vsctl list-ports br0
$ ovs-ofctl dump-ports br0

ovs-vsctl show prints the full bridge/port/interface tree with tags and tunnel options; ovs-ofctl dump-ports shows per-port counters that prove frames are actually flowing. Note that OVS bridges do not run STP by default (ovs-vsctl set bridge br0 stp_enable=true enables it) and that the default datapath ID derives from the lowest non-local MAC among the bridge's ports — set a stable MAC with ovs-vsctl set bridge br0 other_config:hwaddr=... if your hypervisor setup needs one.

Where OVS Fits

OVS bridges underpin KVM/libvirt, Docker hosts and Neutron. If you are coming from Linux-native bridging, compare the access/trunk semantics with Linux VLAN tagging with ip link; for the switch-side view of the same VLAN design see MikroTik bridge VLAN filtering.

原文链接：https://docs.openvswitch.org/en/latest/faq/configuration