zedcode/selfhosted-apps-docker

Fork 0

mirror of https://github.com/DoTheEvo/selfhosted-apps-docker.git synced 2026-07-03 14:06:40 +02:00

Files

T

DoTheEvo 3e8505929b update

2026-01-03 03:07:00 +01:00

13 KiB

Raw Blame History

VLANs Guide

Purpose of VLANs

Separate a network in to smaller segments.
This can improve securirty, ease of managment, reduce unnecessary chatter that can congest larger networks.

Hardware

Whats required before thinking about vlans.

Managed switches as oppose to cheaper typical "dumb switches", as majority of the configuration of vlans is done on switches.
- HPE/Aruba - super reliable, easy to manage, enterprise-grade switches that won't break the bank if it's just about 1gbit.
- Mikrotik or Ubiquiti - usually when in need of something special, like 2.5gbit with some sfp+ or poe
- TP-Link - when just want something cheap, like poe switch for cameras
A router/firewall/gateway device that supports vlans. This will be the linchpin at the center, with separate settings for each vlan - being their gateway, providing them with separate dhcp, applying firewall rules between them,...
- opnsense - is what I use, installed as a virtual machine, but can be installed on any regular old pc, or a miniPC with two intel NICs.
- Ubiquiti UCG-Ultra - solid go-to recommendation.
  
  Reasons...
  * it is **very easy to configure**. * 100€. * ok hardware - 4x arm cores, 3GB RAM, informative lcd display, usb-c power. * full of features - vlans, wireguard VPN, cloud remote managment, geoblocking, basic IDPS, DNS base adblocking, unifi controller for wifi APs,...
  * **Mikrotik** devices are a good pick, but their configuration can be overwhelming. I gave up and use just their switches.

Some basic networking knowledge is required.

You should know about IP addresses, Mac addresses, packets, frames, swiches, routers, about existance of the first 4 OSI layers,..

lets put here also vlan stuff

Two types of VLANs

Port based
A simple separation of ports on a switch, as if you would cut it in to several smaller switches. This is boring, limiting and generally useless, as you would need to deal with extra cables, extra interfaces, extra hardware..
Tag based
The real deal vlan. At layer2 a vlan tag is added to frames. It contains a vlan ID which is a number between 1 and 4094. These are used to create virtual networks that are separate from each other but share same hardware, same cables.
The standard is called 802.1Q.

Some aspects:

Tags are added or removed from frames at physical ports, when entering or leaving switch.
A tag is 4 bytes in size, contains several pieces of info, the most important being vlan ID.
Vlan ID (VID) is just a number between 1-4094, often picked as multiplies of ten - 10, 20, 30, 40, ... with the ip address pool on that VLAN having it somewhere too.
Like vlan30 would be set as 192.168.30.0/24 or 10.30.30.0/24.
A frame can be tagged only for a single vlan, but a port can belong to many vlans.
Tagged frames get dropped if they would arrive to a regular machine, not configured for vlans.

The Core concept

The absofucking essence of VLANs is a clear understanding of two types of traffic - untagged and tagged.

Untagged ports
Called untagged because frames coming in to a switch, or leaving the switch through that one port are not tagged. So that the end device can actually communicate without the need to be configured for vlans.
While the inbound frames, the ones entering the switch through this port are untagged at the moment of entering, they are tagged once inside the switch according to PVID settings for that port, so that they can exit only through other ports tagged with that same VLAN.
Untagged ports are used for end user devices unaware of vlans - computers, printers, ip cameras, IoT devices,...
These are sometimes called access ports, as thats cisco term for them.
- PVID - Port Vlan ID
  Is a setting on a port. Incoming frames entering switch that are not tagged get tagged with this PVID number.
  It might feel weird that for an untagged port you are setting both VLAN ID and PVID when VLAN ID should be enough. It feels like duplication of effort... but its there to solve some hybrid cases.
Tagged ports
Tagged frames going in and out of this kind of ports. Tagged port can carry many VLANs simultaneously if set so, or can carry just one. Purpose is to communicate with other vlan aware devices, like other switches, routers, servers/virtual machines, IP telephones,...
Of note is that setting a port to vlan 4095 allows all vlans to traverse, though it can be manufacturer dependent, if its even allowed to set vlan above 4094.
- Trunk port
  A type of tagged port. The term is used for ports that carry multiple vlans, usually the ones connecting switch with another switch or a server or a router,..
  A tagged port that is not a trunk port would be for example a port that carries just one vlan to a VoIP phone.
- Native vlan
  Frames belonging to native vlan leave the trunk port untagged. The initial reason for the existence of this is to allow older dumb switches to be part of the infrastructure, in between two managed ones. Video.

Setting up VLANs on Routers

Your vlan aware router wil be the linchpin at the center, the gateway to the internet for all vlans, the dhpc server for all vlans, the firewall for all vlans,...

The usual generic steps

creating a new interface or a new network with a specific Vlan ID.
setting a static IP address / subnet the router will have on that network.
setting the dhcp pool for for that network.
maybe enable or restrict the traffic through firewall rules

OPNsense - Router

Isolating Networks in OPNsense

Add new VLAN
Interfaces: Other Types: VLAN
Add; Device = empty; Parent = LAN; VLAN tag = 20; VLAN priority = default; Description = VLAN20WIFI
Assign the new VLAN as an interface
Interfaces: Assignments
Assign a new interface > pick the VLAN from dropbox; Description = vlan_20_wifi
Enter the newly created interface, Enable it; IPv4 Configuration Type = Static IPv4; IPv4 address = 10.20.20.1/24
Setup dhcp servis on the new interface
Services: ISC DHCPv4: [VLAN20WIFI]
Enable; From = 10.20.20.50 To = 10.20.20.200; DNS servers = 10.20.20.1; Gateway = 10.20.20.1
Firewall rule to enable traffic through
Firewall: Rules: VLAN20WIFI
Source = VLAN20WIFI net; save as default is pass and everything

If running opnsense as a virtual machine.

For VLAN aware devices on the network to get through

Edit the port group with the opnsense VM LAN interface and add VLAN ID = 4095
This will allow all VLANs to get through

For a virtual machine on that ESXI host should be on that VLAN

Add new port group, to the virtual switch that opnsense uses for LAN
Name = vlan20; VLAN ID = 20

Now you can edit a VM or create new one, set its Network Adapter to vlan20 and it should get ip address from the vlan 20 dhcp pool.

This is a good test if stuff works as it should before diving in to configuration of VLANs on switches.

Ubiquiti Unifi - Router

Disgustingly simple.

Settings > Networks > New Virtual Network

set Name
turn off Auto-Scale Network
set Gateway IP/Subnet which sets this routers IP on that vlan
set VLAN ID = 20
pick if you want guest network or isolation or disable internet access on it
DHCP set pool range

Setting up VLANs on switches

There are three settings for a port:

PVID - applies to all untagged frames entering the port - ingress. PVID sets vlanID, let's say to 1 This connects the port with all other ports belonging to that vlan-1.
Untagged - similar to PVID but this setting is applied to the frames leaving the port, leaving the switch - egress. The name untagged is telling the whole story - the frames are leaving the switch untagged, the tag is removed before they leave... and the fact that the port is untagged for vlan-1 means the port is connected with all other ports belonging to that vlan-1.
Usually a port has the same PVID and Untagged number set.
Tagged - similar to untagged, it is about the frames leaving the port, but this setting is saying that the frames leave with specific vlan tag, expecting the device connected to this port to be vlan aware.
A port can have both untagged and tagged set.

What happens immediately after you enable VLANs on a switch?

Everything should still work as before.
All ports switch to be untagged ports. So they strip any vlan tags from outbound frames.
PVID on all ports is set to 1, so that incoming frames get tagged as vlan 1, so all ports can communicate with each other.

What happens next is you pick a trunk port, the one communicating with the router or a switch through which multiple vlan goes as set it accordingly to belong to all vlans.
Then pick which ports have device that should be together and separated from the rest and set their vland and PVID.

TP-Link - Switch

Got TL-SG108PE thats a managed switch with PoE. At the moment the situation is that opnsense LAN port is connected to port 7 and testing notebook is connected to port 6.

VLAN > 802.1Q VLAN > set port 7 as tagged and port 6 as untagged.
VLAN > 802.1Q PVID Setting > set port 6 with vlan tag 20

Dunno what is the reason there are two settings, they say PVID is setting specifically to tags incoming frames that come without any tag... but I cant imagine a situation where one would want different number between these two.

MikroTik - Switch

a vlan guide

Bridge section is where all the settings are happening.
This setup is simple layer 2, no routing, not doing anything with interfaces.
Have a bridge, create a new one if you have clean config
Assign all the physical ports to this bridge in Bridge > Ports
Define VLANs in Bridge > VLANs that it should handle.
Set which ports are tagged and which untagged for that vlan
- untagged - outgoing frames are normal - access port - PCs, Printers, TVs,..
- tagged - outgoing frames are tagged - trunks - servers, gateways, wifi APs,...
Set PVIDs for the ports in Bridge > Ports
PVID is about incoming untagged frames entering the switch, what VLAN tag should they get as they move through switch. By default mikrotik switches give tag 1 to all ports.
After everything is configured enable VLAN Filtering on the bridge itself
Bridge > Bridge > bridge > VLAN section

13 KiB Raw Blame History Unescape Escape