VLAN Interfaces (802.1Q) in VyOS

A VLAN (Virtual Local Area Network) lets you split a physical network into several logical networks. VyOS supports IEEE 802.1Q VLAN tagging, allowing you to create VLAN sub-interfaces on physical interfaces.

Overview

Key concepts

VLAN Tag (802.1Q):

12-bit VLAN ID (1-4094)
VLAN 0 is reserved
VLAN 4095 is reserved
Usable range: 1-4094

VLAN port types:

Access Port: Untagged traffic, a single VLAN
Trunk Port: Tagged traffic, multiple VLANs
Hybrid Port: A combination of tagged and untagged

Native VLAN:

Untagged VLAN on a trunk port
VLAN 1 by default
Traffic without a tag belongs to the native VLAN

Benefits of VLANs

Network segmentation - logical separation without additional hardware
Security - traffic isolation between VLANs
Flexibility - easy movement of devices between VLANs
Performance - reduced broadcast domains
Management - simplified network administration

Usage in VyOS

In VyOS, VLANs are implemented as sub-interfaces of physical interfaces:

eth0          - Physical interface (parent)
├── eth0.10   - VLAN 10
├── eth0.20   - VLAN 20
└── eth0.30   - VLAN 30

Basic configuration

Creating a VLAN interface

# VLAN 10 on eth0
set interfaces ethernet eth0 vif 10 address 192.168.10.1/24
set interfaces ethernet eth0 vif 10 description 'Management VLAN'

# VLAN 20 on eth0
set interfaces ethernet eth0 vif 20 address 192.168.20.1/24
set interfaces ethernet eth0 vif 20 description 'Users VLAN'

# VLAN 30 on eth0
set interfaces ethernet eth0 vif 30 address 192.168.30.1/24
set interfaces ethernet eth0 vif 30 description 'Servers VLAN'

commit
save

Note: vif stands for “Virtual Interface”.

Verifying the configuration

# Show all interfaces
show interfaces

# Show a specific VLAN
show interfaces ethernet eth0 vif 10

# Detailed information
show interfaces ethernet eth0 vif 10 detail

# Statistics
show interfaces ethernet eth0 vif 10 statistics

MTU for VLANs

A VLAN adds 4 bytes (the 802.1Q tag), so:

# The parent interface must support the increased MTU
set interfaces ethernet eth0 mtu 1504

# VLAN interface
set interfaces ethernet eth0 vif 10 mtu 1500

commit

Common scenarios

Scenario 1: Basic VLAN segmentation

Requirements:

VLAN 10: Management (192.168.10.0/24)
VLAN 20: Users (192.168.20.0/24)
VLAN 30: Servers (192.168.30.0/24)
VLAN 99: Guest (192.168.99.0/24)

Configuration:

# Parent interface (no IP, trunk only)
set interfaces ethernet eth0 description 'Trunk to Switch'

# VLAN 10 - Management
set interfaces ethernet eth0 vif 10 address 192.168.10.1/24
set interfaces ethernet eth0 vif 10 description 'Management'

# VLAN 20 - Users
set interfaces ethernet eth0 vif 20 address 192.168.20.1/24
set interfaces ethernet eth0 vif 20 description 'Users'

# VLAN 30 - Servers
set interfaces ethernet eth0 vif 30 address 192.168.30.1/24
set interfaces ethernet eth0 vif 30 description 'Servers'

# VLAN 99 - Guest
set interfaces ethernet eth0 vif 99 address 192.168.99.1/24
set interfaces ethernet eth0 vif 99 description 'Guest Network'

commit
save

Scenario 2: VLAN with DHCP

A DHCP server for each VLAN:

# VLAN configuration
set interfaces ethernet eth1 vif 10 address 10.10.10.1/24
set interfaces ethernet eth1 vif 20 address 10.10.20.1/24

# DHCP for VLAN 10
set service dhcp-server shared-network-name VLAN10 subnet 10.10.10.0/24 option default-router 10.10.10.1
set service dhcp-server shared-network-name VLAN10 subnet 10.10.10.0/24 option name-server 10.10.10.1
set service dhcp-server shared-network-name VLAN10 subnet 10.10.10.0/24 range 0 start 10.10.10.100
set service dhcp-server shared-network-name VLAN10 subnet 10.10.10.0/24 range 0 stop 10.10.10.200
set service dhcp-server shared-network-name VLAN10 subnet 10.10.10.0/24 lease 86400

# DHCP for VLAN 20
set service dhcp-server shared-network-name VLAN20 subnet 10.10.20.0/24 option default-router 10.10.20.1
set service dhcp-server shared-network-name VLAN20 subnet 10.10.20.0/24 option name-server 10.10.20.1
set service dhcp-server shared-network-name VLAN20 subnet 10.10.20.0/24 range 0 start 10.10.20.100
set service dhcp-server shared-network-name VLAN20 subnet 10.10.20.0/24 range 0 stop 10.10.20.200

commit
save

Scenario 3: Inter-VLAN Routing

Routing between VLANs:

# VLAN interfaces
set interfaces ethernet eth0 vif 10 address 172.16.10.1/24
set interfaces ethernet eth0 vif 20 address 172.16.20.1/24
set interfaces ethernet eth0 vif 30 address 172.16.30.1/24

# Inter-VLAN routing is enabled by default
# Firewall to control access between VLANs

# Allow VLAN 10 → VLAN 30 (management → servers)
set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 source address 172.16.10.0/24
set firewall ipv4 forward filter rule 100 destination address 172.16.30.0/24

# Allow VLAN 20 → VLAN 30 (users → servers, HTTP/HTTPS only)
set firewall ipv4 forward filter rule 110 action accept
set firewall ipv4 forward filter rule 110 source address 172.16.20.0/24
set firewall ipv4 forward filter rule 110 destination address 172.16.30.0/24
set firewall ipv4 forward filter rule 110 destination port 80,443
set firewall ipv4 forward filter rule 110 protocol tcp

# Block VLAN 20 → VLAN 10 (users cannot reach management)
set firewall ipv4 forward filter rule 120 action drop
set firewall ipv4 forward filter rule 120 source address 172.16.20.0/24
set firewall ipv4 forward filter rule 120 destination address 172.16.10.0/24

commit
save

Scenario 4: VLAN on a Bond interface

VLAN on top of a bond (link aggregation):

# Bond interface
set interfaces bonding bond0 member interface eth0
set interfaces bonding bond0 member interface eth1
set interfaces bonding bond0 mode 802.3ad
set interfaces bonding bond0 description 'LACP to Switch'

# VLAN on the bond
set interfaces bonding bond0 vif 100 address 10.100.0.1/24
set interfaces bonding bond0 vif 100 description 'VLAN 100 on Bond'

set interfaces bonding bond0 vif 200 address 10.200.0.1/24
set interfaces bonding bond0 vif 200 description 'VLAN 200 on Bond'

commit
save

Scenario 5: VLAN with NAT

NAT for VLANs (internet access):

# WAN interface
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'WAN'

# VLANs on the LAN
set interfaces ethernet eth1 vif 10 address 192.168.10.1/24
set interfaces ethernet eth1 vif 20 address 192.168.20.1/24

# NAT for VLAN 10
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.10.0/24
set nat source rule 100 translation address masquerade

# NAT for VLAN 20
set nat source rule 110 outbound-interface name eth0
set nat source rule 110 source address 192.168.20.0/24
set nat source rule 110 translation address masquerade

commit
save

Advanced configurations

QinQ (802.1ad) - VLAN Stacking

Double tagging for service providers:

# Outer VLAN (S-TAG)
set interfaces ethernet eth0 vif-s 100 description 'S-VLAN 100'

# Inner VLAN (C-TAG)
set interfaces ethernet eth0 vif-s 100 vif-c 10 address 10.100.10.1/24
set interfaces ethernet eth0 vif-s 100 vif-c 20 address 10.100.20.1/24

commit

Structure:

eth0
└── vif-s 100 (S-TAG, Outer VLAN)
    ├── vif-c 10 (C-TAG, Inner VLAN)
    └── vif-c 20 (C-TAG, Inner VLAN)

VLAN with multiple IP addresses

# Primary IP
set interfaces ethernet eth0 vif 10 address 192.168.10.1/24

# Additional IPs on the same VLAN
set interfaces ethernet eth0 vif 10 address 192.168.10.2/24
set interfaces ethernet eth0 vif 10 address 192.168.10.3/24

commit

VLAN with IPv6

# Dual-stack VLAN
set interfaces ethernet eth0 vif 10 address 192.168.10.1/24
set interfaces ethernet eth0 vif 10 address 2001:db8:10::1/64

# IPv6 SLAAC
set interfaces ethernet eth0 vif 10 ipv6 address autoconf

commit

Private VLAN (PVLAN)

VyOS has no native PVLAN support, but it can be emulated with a firewall:

# VLAN 50 with host isolation
set interfaces ethernet eth0 vif 50 address 192.168.50.1/24

# Firewall: block hosts from reaching each other
set firewall ipv4 forward filter rule 500 action drop
set firewall ipv4 forward filter rule 500 source address 192.168.50.0/24
set firewall ipv4 forward filter rule 500 destination address 192.168.50.0/24

# Allow access to the gateway
set firewall ipv4 forward filter rule 501 action accept
set firewall ipv4 forward filter rule 501 destination address 192.168.50.1

commit

VLAN with VRRP (High Availability)

# Router 1
set interfaces ethernet eth0 vif 10 address 192.168.10.2/24

set high-availability vrrp group VLAN10 vrid 10
set high-availability vrrp group VLAN10 interface eth0.10
set high-availability vrrp group VLAN10 address 192.168.10.1/24
set high-availability vrrp group VLAN10 priority 200

# Router 2
set interfaces ethernet eth0 vif 10 address 192.168.10.3/24

set high-availability vrrp group VLAN10 vrid 10
set high-availability vrrp group VLAN10 interface eth0.10
set high-availability vrrp group VLAN10 address 192.168.10.1/24
set high-availability vrrp group VLAN10 priority 100

commit

VLAN with dynamic routing (OSPF)

# VLAN interfaces
set interfaces ethernet eth0 vif 10 address 10.0.10.1/24
set interfaces ethernet eth0 vif 20 address 10.0.20.1/24

# OSPF on the VLANs
set protocols ospf area 0 network 10.0.10.0/24
set protocols ospf area 0 network 10.0.20.0/24

# Or specifically on the interfaces
set protocols ospf interface eth0.10 area 0
set protocols ospf interface eth0.20 area 0

commit

VLAN with bandwidth shaping

# VLAN interface
set interfaces ethernet eth0 vif 20 address 192.168.20.1/24

# Traffic policy (QoS)
set traffic-policy shaper VLAN20-LIMIT bandwidth 100mbit
set traffic-policy shaper VLAN20-LIMIT default bandwidth 80mbit

# Apply to the VLAN
set interfaces ethernet eth0 vif 20 traffic-policy out VLAN20-LIMIT

commit

Firewall and security

VLAN isolation

Full isolation of VLANs from each other:

# Block all inter-VLAN traffic
set firewall ipv4 forward filter default-action drop

# Allow only established/related
set firewall ipv4 forward filter rule 10 action accept
set firewall ipv4 forward filter rule 10 state established
set firewall ipv4 forward filter rule 10 state related

commit

Selective access between VLANs

# VLAN 10: 192.168.10.0/24 (Admin)
# VLAN 20: 192.168.20.0/24 (Users)
# VLAN 30: 192.168.30.0/24 (Servers)

# Admin can reach everything
set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 source address 192.168.10.0/24

# Users → Servers (HTTP/HTTPS/DNS only)
set firewall ipv4 forward filter rule 110 action accept
set firewall ipv4 forward filter rule 110 source address 192.168.20.0/24
set firewall ipv4 forward filter rule 110 destination address 192.168.30.0/24
set firewall ipv4 forward filter rule 110 destination port 80,443,53
set firewall ipv4 forward filter rule 110 protocol tcp

# Servers → Users (deny)
set firewall ipv4 forward filter rule 120 action drop
set firewall ipv4 forward filter rule 120 source address 192.168.30.0/24
set firewall ipv4 forward filter rule 120 destination address 192.168.20.0/24

# Users → Admin (deny)
set firewall ipv4 forward filter rule 130 action drop
set firewall ipv4 forward filter rule 130 source address 192.168.20.0/24
set firewall ipv4 forward filter rule 130 destination address 192.168.10.0/24

commit

Guest VLAN with restrictions

# Guest VLAN 99
set interfaces ethernet eth0 vif 99 address 192.168.99.1/24

# DHCP for guests
set service dhcp-server shared-network-name GUEST subnet 192.168.99.0/24 option default-router 192.168.99.1
set service dhcp-server shared-network-name GUEST subnet 192.168.99.0/24 option name-server 8.8.8.8
set service dhcp-server shared-network-name GUEST subnet 192.168.99.0/24 range 0 start 192.168.99.100
set service dhcp-server shared-network-name GUEST subnet 192.168.99.0/24 range 0 stop 192.168.99.200
set service dhcp-server shared-network-name GUEST subnet 192.168.99.0/24 lease 3600

# NAT for internet access
set nat source rule 990 outbound-interface name eth1
set nat source rule 990 source address 192.168.99.0/24
set nat source rule 990 translation address masquerade

# Firewall: internet only, block local networks
set firewall ipv4 forward filter rule 990 action drop
set firewall ipv4 forward filter rule 990 source address 192.168.99.0/24
set firewall ipv4 forward filter rule 990 destination address 192.168.0.0/16

set firewall ipv4 forward filter rule 991 action drop
set firewall ipv4 forward filter rule 991 source address 192.168.99.0/24
set firewall ipv4 forward filter rule 991 destination address 10.0.0.0/8

set firewall ipv4 forward filter rule 992 action drop
set firewall ipv4 forward filter rule 992 source address 192.168.99.0/24
set firewall ipv4 forward filter rule 992 destination address 172.16.0.0/12

# Allow internet (everything else)
set firewall ipv4 forward filter rule 999 action accept
set firewall ipv4 forward filter rule 999 source address 192.168.99.0/24

commit

Monitoring and diagnostics

Checking VLAN interfaces

# List all VLANs
show interfaces

# VLAN interface details
show interfaces ethernet eth0 vif 10

# Statistics
show interfaces ethernet eth0 vif 10 statistics

# Packets
show interfaces ethernet eth0 vif 10 statistics

VLAN tagging verification

# tcpdump on the parent interface (VLAN tags are visible)
sudo tcpdump -i eth0 -e -n

# tcpdump on the VLAN interface (no tags)
sudo tcpdump -i eth0.10 -n

# Show VLAN tagged packets
sudo tcpdump -i eth0 'vlan'

# A specific VLAN
sudo tcpdump -i eth0 'vlan 10'

Connectivity checks

# Ping with source
ping 192.168.20.10 source-address 192.168.10.1

# Traceroute
traceroute 192.168.30.10

# Check MAC addresses
show arp interface eth0.10

Checking the VLAN table

# On the parent interface
cat /proc/net/vlan/eth0.10

# Kernel VLAN table
cat /proc/net/vlan/config

Output:

VLAN Dev name    | VLAN ID
Name-Type: VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD
eth0.10        | 10  | eth0
eth0.20        | 20  | eth0
eth0.30        | 30  | eth0

Troubleshooting

VLAN interface does not come up

Problem: The VLAN interface is in the down state.

Causes:

The parent interface is down
The VLAN is not configured on the switch
Incorrect VLAN ID

Diagnostics:

# Check the parent
show interfaces ethernet eth0

# Check the VLAN
show interfaces ethernet eth0 vif 10

# Kernel messages
dmesg | grep eth0

Solution:

# Make sure the parent interface is up
set interfaces ethernet eth0 disable false

# Verify the VLAN configuration on the switch

No connectivity between VLANs

Problem: Devices in different VLANs cannot communicate.

Causes:

Inter-VLAN routing is not working
The firewall is blocking traffic
Incorrect default gateway on the clients

Diagnostics:

# Check routing
show ip route

# Check the firewall
show firewall ipv4 forward filter

# Ping with source
ping 192.168.20.10 source-address 192.168.10.1

Solution:

# Verify that IP forwarding is enabled (enabled by default)
cat /proc/sys/net/ipv4/ip_forward
# Should be 1

# Check the firewall rules
show firewall ipv4 forward filter

# Add a rule if needed
set firewall ipv4 forward filter rule 100 action accept

VLAN traffic is not tagged

Problem: Traffic on the switch has no VLAN tags.

Causes:

The switch port is in access mode instead of trunk
Native VLAN mismatch

Solution: On the switch (Cisco example):

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

MTU issues with VLANs

Problem: Packets are fragmented or lost.

Cause: A VLAN adds 4 bytes, but the MTU does not account for it.

Solution:

# Increase the MTU on the parent
set interfaces ethernet eth0 mtu 1504

# Or decrease it on the VLAN
set interfaces ethernet eth0 vif 10 mtu 1496

commit

Broadcast storm in a VLAN

Problem: High CPU load, the network is slow.

Causes:

A loop in the network
No STP
Broadcast traffic

Diagnostics:

# Watch broadcast packets
sudo tcpdump -i eth0.10 broadcast -c 100

# Error statistics
show interfaces ethernet eth0 vif 10 statistics

Solution:

Enable STP on the switches
Check the topology for loops
Limit broadcast traffic (storm-control on the switch)

Integration with switches

Cisco IOS

! Trunk port to VyOS
interface GigabitEthernet0/1
 description Trunk to VyOS
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
 switchport trunk native vlan 999
 spanning-tree portfast trunk

HP/Aruba

! Trunk to VyOS
interface 1
 name "Trunk to VyOS"
 tagged vlan 10,20,30,99
 untagged vlan 999

Mikrotik

# VLANs on a bridge
/interface vlan
add interface=bridge1 name=vlan10 vlan-id=10
add interface=bridge1 name=vlan20 vlan-id=20

# Trunk port
/interface bridge port
add bridge=bridge1 interface=ether1 comment="Trunk to VyOS"

# VLAN filtering
/interface bridge vlan
add bridge=bridge1 tagged=ether1 vlan-ids=10,20,30

Linux Bridge

# VLAN on a Linux server
ip link add link eth0 name eth0.10 type vlan id 10
ip addr add 192.168.10.100/24 dev eth0.10
ip link set eth0.10 up

Real-world configuration examples

Example 1: Small office (SOHO)

Topology:

VLAN 10: Management (192.168.10.0/24)
VLAN 20: Office (192.168.20.0/24)
VLAN 30: WiFi (192.168.30.0/24)

# WAN
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'Internet'

# LAN trunk
set interfaces ethernet eth1 description 'LAN Trunk'

# Management VLAN
set interfaces ethernet eth1 vif 10 address 192.168.10.1/24
set interfaces ethernet eth1 vif 10 description 'Management'

# Office VLAN
set interfaces ethernet eth1 vif 20 address 192.168.20.1/24
set interfaces ethernet eth1 vif 20 description 'Office Network'

# WiFi VLAN
set interfaces ethernet eth1 vif 30 address 192.168.30.1/24
set interfaces ethernet eth1 vif 30 description 'WiFi'

# DHCP for all VLANs
set service dhcp-server shared-network-name MGMT subnet 192.168.10.0/24 option default-router 192.168.10.1
set service dhcp-server shared-network-name MGMT subnet 192.168.10.0/24 range 0 start 192.168.10.100
set service dhcp-server shared-network-name MGMT subnet 192.168.10.0/24 range 0 stop 192.168.10.200

set service dhcp-server shared-network-name OFFICE subnet 192.168.20.0/24 option default-router 192.168.20.1
set service dhcp-server shared-network-name OFFICE subnet 192.168.20.0/24 range 0 start 192.168.20.100
set service dhcp-server shared-network-name OFFICE subnet 192.168.20.0/24 range 0 stop 192.168.20.200

set service dhcp-server shared-network-name WIFI subnet 192.168.30.0/24 option default-router 192.168.30.1
set service dhcp-server shared-network-name WIFI subnet 192.168.30.0/24 range 0 start 192.168.30.100
set service dhcp-server shared-network-name WIFI subnet 192.168.30.0/24 range 0 stop 192.168.30.200

# NAT for all
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.0.0/16
set nat source rule 100 translation address masquerade

# Firewall: WiFi isolated from local networks
set firewall ipv4 forward filter rule 300 action drop
set firewall ipv4 forward filter rule 300 source address 192.168.30.0/24
set firewall ipv4 forward filter rule 300 destination address 192.168.10.0/24

set firewall ipv4 forward filter rule 301 action drop
set firewall ipv4 forward filter rule 301 source address 192.168.30.0/24
set firewall ipv4 forward filter rule 301 destination address 192.168.20.0/24

commit
save

Example 2: Enterprise with many VLANs

Topology:

VLAN 10: Management
VLAN 20: Employees
VLAN 30: Servers
VLAN 40: VoIP
VLAN 50: CCTV
VLAN 99: Guest

# Trunk interface
set interfaces ethernet eth0 description 'Core Switch Trunk'
set interfaces ethernet eth0 mtu 1600

# Management
set interfaces ethernet eth0 vif 10 address 10.0.10.1/24
set interfaces ethernet eth0 vif 10 description 'Management VLAN'

# Employees
set interfaces ethernet eth0 vif 20 address 10.0.20.1/24
set interfaces ethernet eth0 vif 20 description 'Employees'

# Servers
set interfaces ethernet eth0 vif 30 address 10.0.30.1/24
set interfaces ethernet eth0 vif 30 description 'Servers'

# VoIP
set interfaces ethernet eth0 vif 40 address 10.0.40.1/24
set interfaces ethernet eth0 vif 40 description 'VoIP'

# CCTV
set interfaces ethernet eth0 vif 50 address 10.0.50.1/24
set interfaces ethernet eth0 vif 50 description 'CCTV'

# Guest
set interfaces ethernet eth0 vif 99 address 10.0.99.1/24
set interfaces ethernet eth0 vif 99 description 'Guest WiFi'

# QoS for the VoIP VLAN
set traffic-policy shaper VOIP bandwidth 100mbit
set traffic-policy shaper VOIP default bandwidth 100mbit
set traffic-policy shaper VOIP default priority 7
set interfaces ethernet eth0 vif 40 traffic-policy out VOIP

# Firewall access matrix
# Management → All
set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 source address 10.0.10.0/24

# Employees → Servers (limited ports)
set firewall ipv4 forward filter rule 110 action accept
set firewall ipv4 forward filter rule 110 source address 10.0.20.0/24
set firewall ipv4 forward filter rule 110 destination address 10.0.30.0/24
set firewall ipv4 forward filter rule 110 destination port 80,443,3389
set firewall ipv4 forward filter rule 110 protocol tcp

# VoIP isolated (only to servers for call control)
set firewall ipv4 forward filter rule 140 action accept
set firewall ipv4 forward filter rule 140 source address 10.0.40.0/24
set firewall ipv4 forward filter rule 140 destination address 10.0.30.100
set firewall ipv4 forward filter rule 140 destination port 5060,5061
set firewall ipv4 forward filter rule 140 protocol udp

# CCTV isolated (only to NVR server)
set firewall ipv4 forward filter rule 150 action accept
set firewall ipv4 forward filter rule 150 source address 10.0.50.0/24
set firewall ipv4 forward filter rule 150 destination address 10.0.30.200

# Guest fully isolated
set firewall ipv4 forward filter rule 190 action drop
set firewall ipv4 forward filter rule 190 source address 10.0.99.0/24
set firewall ipv4 forward filter rule 190 destination address 10.0.0.0/8

commit
save

Best practices

VLAN ID planning:
- Use a logical scheme (10-19 management, 20-29 users, etc.)
- Document VLAN IDs and their purpose
- Reserve ranges for future growth
MTU configuration:
- Parent interface: MTU 1504 or higher
- VLAN interface: MTU 1500
- Jumbo frames: account for the extra 4 bytes
Interface descriptions:
- Always add a description for a VLAN
- Specify the purpose and contact information
Security:
- Use a firewall to control inter-VLAN routing
- Isolate guest networks
- Limit broadcast traffic
DHCP configuration:
- Separate DHCP pools for each VLAN
- Use DHCP options (DNS, NTP, domain)
- Configure DHCP snooping on the switches
QoS for critical VLANs:
- The VoIP VLAN should have priority
- Real-time traffic (video) requires guaranteed bandwidth
Monitoring:
- Track the state of VLAN interfaces
- Log VLAN changes
- Alert on the down state
Configuration backup:
- Save the configuration regularly
- Document the VLAN topology
- Keep network diagrams
Native VLAN:
- Do not use VLAN 1 as the native VLAN
- Use an unused VLAN as the native one (for example, 999)
- Ensure native VLAN consistency across all trunk ports
Testing:
- Test connectivity between VLANs
- Verify firewall rules
- Verify QoS policies
- Test failover if redundancy is present

Conclusion

VLANs in VyOS provide a flexible and powerful mechanism for network segmentation. Proper use of VLANs allows you to:

Improve security through isolation
Optimize network performance
Simplify management and scaling
Implement QoS for critical services

VyOS supports all modern VLAN features, including 802.1Q tagging, QinQ (802.1ad), VLAN on bond interfaces, and full integration with firewall, NAT, routing, and QoS.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

Ethernet Interfaces in VyOS Bridge Interfaces (L2) in VyOS