LFCE 23 🐧 VLANs — Concepts - KandZ

⏱️ Estimated read: 14 min | |

A VLAN is a logical subdivision of a physical LAN. It allows a single switch, or a single Linux host acting as a switch, to present multiple isolated broadcast domains over the same physical infrastructure. Devices in one VLAN cannot reach devices in another VLAN at Layer 2, even if they are connected to the same switch and the same physical cable. The isolation is enforced by tags—four-byte headers inserted into Ethernet frames—that identify which VLAN a frame belongs to. On Linux, a VLAN is represented as a virtual interface, typically named eth0.100 for VLAN ID 100 on the physical interface eth0 .

For the LFCE candidate, VLANs are the mechanism that connects interface configuration to network segmentation. The exam objectives include configuring a system to route IP traffic and implementing advanced packet filtering, and VLANs are the layer beneath both: a router with a VLAN interface on each subnet can route between them, and firewall rules can be applied per VLAN interface. Understanding the tagging format, the interface model, and the isolation guarantee is the foundation for configuring VLANs correctly.

Key point: A VLAN tag is part of the Ethernet frame, not the IP packet. The Linux kernel strips the tag when it presents the frame to a VLAN interface, and inserts the tag when it transmits from that interface. The physical interface carries tagged frames; the VLAN interface carries untagged frames. A switch port configured as an access port strips tags before delivering frames to an end device; a trunk port carries tagged frames between switches.

Why VLANs exist

The broadcast domain problem.

A physical LAN is a single broadcast domain. Every broadcast frame—ARP requests, DHCP discoveries, NetBIOS announcements—is delivered to every device on the segment. In a small office, this is manageable. In a building with hundreds of devices, the broadcast traffic consumes bandwidth and CPU on hosts that have no interest in the broadcasts. VLANs divide the broadcast domain without requiring separate physical switches. A single switch can host multiple VLANs, and each VLAN is its own broadcast domain. Broadcasts in VLAN 10 are delivered only to ports assigned to VLAN 10 .

The segmentation problem.

Physical separation is expensive. Running a separate cable and a separate switch for each department, each tenant, or each security zone multiplies hardware costs and management overhead. VLANs provide the same isolation logically. A port assigned to VLAN 20 cannot communicate with a port assigned to VLAN 30 at Layer 2, even though both ports are on the same switch. The isolation is enforced by the switch’s forwarding logic and the VLAN tags in the frames. For Linux hosts, the kernel provides the same isolation through VLAN interfaces: traffic sent on eth0.100 is tagged with VLAN 100, and traffic sent on eth0.200 is tagged with VLAN 200. The two interfaces share the physical link but do not share a broadcast domain .

The trunk problem.

Connecting two switches that carry multiple VLANs requires a link that can carry frames from all VLANs simultaneously. This is the trunk link. The trunk carries tagged frames, and each frame’s tag identifies its VLAN. The receiving switch reads the tag and forwards the frame only to ports in that VLAN. On Linux, the physical interface (eth0) carries the tagged frames, and the VLAN interfaces (eth0.100, eth0.200) represent the individual VLANs. The physical interface does not have an IP address in a trunk configuration; the VLAN interfaces do. This mirrors the switch model: the trunk port is not a member of any single VLAN, and the access ports are members of exactly one .

a. The 802.1Q tag format

IEEE 802.1Q is the standard for VLAN tagging in Ethernet networks. The tag is four bytes inserted after the source MAC address and before the EtherType field of the original frame. The tag consists of a 16-bit Tag Protocol Identifier (TPID) and a 16-bit Tag Control Information (TCI) field .

The TPID for 802.1Q is 0x8100. This value tells the receiving device that the frame carries a VLAN tag. The TCI field contains three subfields: a 3-bit Priority Code Point (PCP) for quality of service, a 1-bit Drop Eligible Indicator (DEI), and a 12-bit VLAN Identifier (VID). The VID is the number that identifies the VLAN. Valid VID values range from 0 to 4095, but 0 and 4095 are reserved, leaving 4094 usable VLANs .

On Linux, the tag is managed by the kernel. When a frame is transmitted on eth0.100, the kernel inserts the 802.1Q tag with VID 100. When a tagged frame arrives on eth0 with VID 100, the kernel strips the tag and delivers the untagged frame to eth0.100. The physical interface eth0 is the trunk; the VLAN interface eth0.100 is the access representation. This is why the physical interface must be up before the VLAN interface can function, and why the VLAN interface has its own IP address, MTU, and routing entries .

b. The Linux VLAN interface model

The Linux kernel presents each VLAN as a separate network interface. The naming convention eth0.100 is not enforced; it is a convention that makes the relationship clear. The ip link add command creates the interface, and the -d flag in ip -d link show displays the VLAN ID and protocol, confirming the tag association .

The VLAN interface behaves like a physical interface for most purposes. It can be assigned an IP address, brought up or down, and included in routing tables. It can be enslaved to a bridge, though the bridge must be VLAN-aware if it is to forward frames from multiple VLANs. The kernel documentation notes that VLAN filtering on a bridge is disabled by default; when enabled, the bridge forwards frames based on both destination MAC address and VLAN tag, and both must match .

The kernel maintains a distinction between the physical interface and the VLAN interface. The physical interface receives tagged frames; the VLAN interface receives untagged frames. If a tagged frame arrives on a physical interface and no matching VLAN interface exists, the kernel drops the frame. If an untagged frame arrives on a physical interface that is expected to carry tagged traffic, the kernel treats it as belonging to the native VLAN (if one is configured) or drops it. This behavior is what enforces the isolation: traffic for a VLAN that is not configured on the host cannot enter the host’s network stack .

c. Access ports, trunk ports, and the native VLAN

The switch port configuration determines how tags are handled at the boundary between the switch and the end device. An access port is assigned to a single VLAN. Frames transmitted from the switch to the end device are untagged; the switch strips the tag before sending. Frames received from the end device are untagged; the switch inserts the tag for the assigned VLAN before forwarding. The end device does not need to be VLAN-aware because it never sees a tag .

A trunk port carries frames from multiple VLANs. Frames transmitted from the switch to the connected device are tagged with their VLAN ID. Frames received from the connected device must be tagged, and the switch uses the tag to determine which VLAN the frame belongs to. A Linux host acting as a router or a virtualization server typically uses a trunk port: the physical interface carries tagged frames, and the VLAN interfaces represent the individual subnets.

The native VLAN is the VLAN whose frames are transmitted untagged on a trunk port. By default, the native VLAN is VLAN 1 on most switches. Frames belonging to the native VLAN are sent without a tag, and untagged frames received on the trunk are assigned to the native VLAN. This is a source of security concerns because untagged frames can be used to hop between VLANs if the native VLAN is not configured consistently. On Linux, the native VLAN behavior is controlled by the egress-qos-map and ingress-qos-map options, but in most router configurations, the native VLAN is avoided by configuring all VLANs as tagged on the trunk .

Complete Example Session

# ============================================
# PART 1: INSPECT THE PHYSICAL INTERFACE
# ============================================
ip link show eth0
# The physical interface must be up before VLAN interfaces can function
# It should not have an IP address in a trunk configuration

# ============================================
# PART 2: CREATE A VLAN INTERFACE
# ============================================
# Create eth0.100 for VLAN 100
ip link add link eth0 name eth0.100 type vlan id 100

# ============================================
# PART 3: VERIFY THE VLAN INTERFACE
# ============================================
# The -d flag shows the VLAN ID and protocol
ip -d link show eth0.100
# Output includes: vlan protocol 802.1Q id 100

# ============================================
# PART 4: ASSIGN AN IP ADDRESS
# ============================================
# The VLAN interface is the access representation of VLAN 100
ip addr add 192.168.100.1/24 dev eth0.100

# ============================================
# PART 5: BRING UP THE INTERFACE
# ============================================
ip link set dev eth0.100 up

# ============================================
# PART 6: CREATE A SECOND VLAN
# ============================================
ip link add link eth0 name eth0.200 type vlan id 200
ip addr add 192.168.200.1/24 dev eth0.200
ip link set dev eth0.200 up

# ============================================
# PART 7: VERIFY ISOLATION
# ============================================
# Traffic sent on eth0.100 is tagged with VLAN 100
# Traffic sent on eth0.200 is tagged with VLAN 200
# A device on VLAN 100 cannot reach a device on VLAN 200 at Layer 2
ip route show
# The kernel has routes for both subnets, each via its VLAN interface

# ============================================
# PART 8: ENABLE ROUTING BETWEEN VLANS
# ============================================
# The host acts as a router between the two VLANs
sysctl -w net.ipv4.ip_forward=1

# ============================================
# PART 9: INSPECT THE TAG IN CAPTURED TRAFFIC
# ============================================
# Capture traffic on the physical interface
tcpdump -i eth0 -e -n vlan
# Output shows 802.1Q tags with the VLAN ID for each frame

# ============================================
# PART 10: REMOVE THE VLAN INTERFACE
# ============================================
ip link set dev eth0.100 down
ip link delete eth0.100

The ten parts demonstrate the complete VLAN configuration: create the interface, assign an address, verify the tag association, create a second VLAN, confirm isolation, enable routing between the VLANs, and inspect the tagged traffic on the physical link. The critical verification is ip -d link show, which confirms that the interface is associated with the correct VLAN ID.

Quick Reference

VLAN Commands

Task	Command
Create VLAN	`ip link add link eth0 name eth0.100 type vlan id 100`
Show VLAN details	`ip -d link show eth0.100`
Assign IP	`ip addr add <addr>/<prefix> dev eth0.100`
Bring up	`ip link set eth0.100 up`
Delete VLAN	`ip link delete eth0.100`
Capture tagged traffic	`tcpdump -i eth0 -e -n vlan`

802.1Q Tag Fields

Field	Size	Purpose
TPID	16 bits	`0x8100` identifies an 802.1Q tag
PCP	3 bits	Priority code point (QoS)
DEI	1 bit	Drop eligible indicator
VID	12 bits	VLAN identifier (0–4095)

Port Types

Port Type	Tag Behavior	Typical Use
Access	Untagged to end device	End host connection
Trunk	Tagged for all VLANs	Switch-to-switch, host router
Native VLAN	Untagged on trunk	Legacy compatibility

Best Practices

✅ Do This:

# Use the ip command, not the deprecated vconfig
ip link add link eth0 name eth0.100 type vlan id 100          # ✅

# Verify the VLAN ID with ip -d
ip -d link show eth0.100                                      # ✅

# Assign the IP to the VLAN interface, not the physical interface
ip addr add 192.168.100.1/24 dev eth0.100                     # ✅

# Enable forwarding if routing between VLANs
sysctl -w net.ipv4.ip_forward=1                               # ✅

# Inspect tags on the physical interface
tcpdump -i eth0 -e -n vlan                                    # ✅

# Use the naming convention eth0.VID for clarity
ip link add link eth0 name eth0.100 type vlan id 100          # ✅

❌ Don’t Do This:

# Use vconfig (deprecated)
vconfig add eth0 100                                          # ❌

# Assign an IP to the physical interface in a trunk configuration
ip addr add 192.168.1.1/24 dev eth0    # Conflicts with VLANs # ❌

# Assume an access port requires VLAN configuration on the host
# Access ports send untagged frames; the host does not need a VLAN interface # ❌

# Create a VLAN interface on a down physical interface
# The VLAN cannot transmit until the physical is up                # ❌

# Expect Layer 2 connectivity between VLANs without routing
# VLANs are isolated broadcast domains                             # ❌

# Forget that the VLAN interface inherits the physical MTU
# Tagged frames add 4 bytes; adjust MTU if necessary               # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
VLAN interface cannot send traffic	Physical interface is down	`ip link set eth0 up`
Tagged frames dropped	No matching VLAN interface	Create the VLAN interface
Cannot reach another VLAN	No routing between VLANs	Enable `ip_forward` and add routes
`ip -d link show` does not show VLAN ID	Interface created without `type vlan`	Recreate with the correct syntax
Traffic untagged on trunk	Native VLAN configured	Ensure all VLANs are tagged
MTU issues with tagged frames	Tag adds 4 bytes	Adjust MTU on physical or VLAN interface

Real-World Examples

1. Create a VLAN interface

ip link add link eth0 name eth0.100 type vlan id 100

2. Assign an IP to a VLAN

ip addr add 192.168.100.1/24 dev eth0.100

3. Bring up a VLAN

ip link set eth0.100 up

4. Show VLAN details

ip -d link show eth0.100

5. Create multiple VLANs

ip link add link eth0 name eth0.100 type vlan id 100
ip link add link eth0 name eth0.200 type vlan id 200

6. Enable routing between VLANs

sysctl -w net.ipv4.ip_forward=1

7. Capture tagged traffic

tcpdump -i eth0 -e -n vlan

8. Delete a VLAN interface

ip link delete eth0.100

9. Check VLAN protocol

ip -d link show eth0.100 | grep vlan

10. Verify isolation

ping -I eth0.100 192.168.200.1    # Should fail without routing

Visual

802.1Q Tag Insertion

┌──────────────────────────────────────────────────────────────┐
│  THE TAG IS INSERTED AFTER THE SOURCE MAC ADDRESS            │
│                                                              │
│  Original Ethernet frame:                                    │
│  ┌──────────┬──────────┬──────────┬───────────────────────┐  │
│  │ Dst MAC  │ Src MAC  │ EtherType│ Payload               │  │
│  └──────────┴──────────┴──────────┴───────────────────────┘  │
│                                                              │
│  802.1Q tagged frame:                                        │
│  ┌──────────┬──────────┬──────────┬──────────┬────────────┐  │
│  │ Dst MAC  │ Src MAC  │ TPID     │ TCI      │ EtherType  │  │
│  │          │          │ 0x8100   │ PCP/DEI/ │            │  │
│  │          │          │          │ VID      │            │  │
│  └──────────┴──────────┴──────────┴──────────┴────────────┘  │
│                                                              │
│  TCI: 12-bit VID identifies the VLAN                         │
│  The tag is 4 bytes; MTU is reduced by 4 if not adjusted     │
└──────────────────────────────────────────────────────────────┘

Linux VLAN Interface Model

┌──────────────────────────────────────────────────────────────┐
│  PHYSICAL INTERFACE CARRIES TAGGED FRAMES;                   │
│  VLAN INTERFACES CARRY UNTAGGED FRAMES                       │
│                                                              │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ eth0.100 (192.168.100.1/24)                            │  │
│  │   ↑ untagged frames from kernel                        │  │
│  │   │ kernel inserts tag VID 100 on transmit             │  │
│  │   │ kernel strips tag VID 100 on receive               │  │
│  │   ▼                                                    │  │
│  │ eth0 (physical, no IP)                                 │  │
│  │   ↑ tagged frames                                      │  │
│  │   │ 802.1Q tag in frame                                │  │
│  │   ▼                                                    │  │
│  │ Wire / trunk to switch                                 │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  eth0.200 (192.168.200.1/24) is a separate VLAN interface    │
│  on the same physical eth0.                                │
└──────────────────────────────────────────────────────────────┘

Access vs Trunk Ports

┌──────────────────────────────────────────────────────────────┐
│  ACCESS PORTS STRIP TAGS; TRUNK PORTS CARRY TAGS             │
│                                                              │
│  Access port (VLAN 100):                                     │
│  ┌────────┐     ┌────────┐     ┌────────┐                    │
│  │ Host   │────▶│ Switch │────▶│ Switch │                    │
│  │(no tag)│     │(adds   │     │(strips │                    │
│  │        │◀────│ tag 100)│◀────│ tag 100)│                    │
│  └────────┘     └────────┘     └────────┘                    │
│                                                              │
│  Trunk port (VLANs 100, 200):                                │
│  ┌────────┐     ┌────────┐     ┌────────┐                    │
│  │ Switch │────▶│ Switch │────▶│ Switch │                    │
│  │(tagged)│     │(tagged)│     │(tagged)│                    │
│  │        │◀────│        │◀────│        │                    │
│  └────────┘     └────────┘     └────────┘                    │
│                                                              │
│  End devices on access ports do not need VLAN configuration. │
│  Routers and virtualization hosts use trunk ports.           │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Standard	IEEE 802.1Q
Tag size	4 bytes
TPID value	`0x8100`
VID range	0–4095 (0 and 4095 reserved)
Usable VLANs	4094
Linux interface naming	`eth0.VID` (convention)
Physical interface role	Carries tagged frames (trunk)
VLAN interface role	Carries untagged frames (access representation)
Access port	Untagged to end device
Trunk port	Tagged for all VLANs
Isolation	Layer 2 broadcast domain separation

Key takeaways:

A VLAN is a tagged broadcast domain. The tag identifies which VLAN a frame belongs to, and the switch or kernel forwards the frame only to ports or interfaces in that VLAN. Devices in different VLANs cannot communicate at Layer 2 .
Linux presents each VLAN as a separate interface. The physical interface carries tagged frames; the VLAN interface carries untagged frames. The kernel inserts and strips tags transparently. The IP address belongs on the VLAN interface, not the physical interface .
The tag is four bytes, inserted after the source MAC. The VID is 12 bits, allowing 4094 usable VLANs. The tag is part of the Ethernet frame, not the IP packet, so it is invisible to IP-level tools unless they are VLAN-aware.
Access ports strip tags; trunk ports carry them. An end device on an access port does not need VLAN configuration because it never sees a tag. A router or virtualization host on a trunk port uses VLAN interfaces to separate the tagged traffic into untagged streams .
Isolation is enforced at Layer 2. Two VLAN interfaces on the same Linux host cannot exchange frames directly, even though they share a physical link. Routing between them requires ip_forward and a route for each subnet.
ip -d link show verifies the VLAN association. The output includes the VLAN ID and protocol. If the interface was created without type vlan, the association does not exist, and tagged frames will be dropped .

Remember: A VLAN is not a separate physical network. It is a tag in the Ethernet frame that tells the switch, or the kernel, which logical network the frame belongs to. On Linux, the physical interface carries the tags, and the VLAN interfaces represent the untagged views of each logical network. Create the VLAN interface, assign the IP address, and verify the tag association with ip -d link show. The physical interface remains the trunk; the VLAN interfaces are the access points to the isolated broadcast domains.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!