# VLAN Interfaces (802.1Q) in VyOS

> Configure 802.1Q VLAN interfaces in VyOS: tagged and untagged ports, QinQ (802.1ad), inter-VLAN routing and trunk ports for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/interfaces/vyos-vlan/



A VLAN (Virtual Local Area Network) lets you split a physical network into several logical networks. VyOS supports IEEE 802.1Q VLAN tagging, allowing you to create VLAN sub-interfaces on physical interfaces.

## Overview

### Key concepts

**VLAN Tag (802.1Q)**:
- 12-bit VLAN ID (1-4094)
- VLAN 0 is reserved
- VLAN 4095 is reserved
- Usable range: 1-4094

**VLAN port types**:
- **Access Port**: Untagged traffic, a single VLAN
- **Trunk Port**: Tagged traffic, multiple VLANs
- **Hybrid Port**: A combination of tagged and untagged

**Native VLAN**:
- Untagged VLAN on a trunk port
- VLAN 1 by default
- Traffic without a tag belongs to the native VLAN

### Benefits of VLANs

1. **Network segmentation** - logical separation without additional hardware
2. **Security** - traffic isolation between VLANs
3. **Flexibility** - easy movement of devices between VLANs
4. **Performance** - reduced broadcast domains
5. **Management** - simplified network administration

### Usage in VyOS

In VyOS, VLANs are implemented as sub-interfaces of physical interfaces:

```
eth0          - Physical interface (parent)
├── eth0.10   - VLAN 10
├── eth0.20   - VLAN 20
└── eth0.30   - VLAN 30
```

## Basic configuration

### Creating a VLAN interface

```bash
# VLAN 10 on eth0
set interfaces ethernet eth0 vif 10 address 192.168.10.1/24
set interfaces ethernet eth0 vif 10 description 'Management VLAN'

# VLAN 20 on eth0
set interfaces ethernet eth0 vif 20 address 192.168.20.1/24
set interfaces ethernet eth0 vif 20 description 'Users VLAN'

# VLAN 30 on eth0
set interfaces ethernet eth0 vif 30 address 192.168.30.1/24
set interfaces ethernet eth0 vif 30 description 'Servers VLAN'

commit
save
```

**Note**: `vif` stands for "Virtual Interface".

### Verifying the configuration

```bash
# Show all interfaces
show interfaces

# Show a specific VLAN
show interfaces ethernet eth0 vif 10

# Detailed information
show interfaces ethernet eth0 vif 10 detail

# Statistics
show interfaces ethernet eth0 vif 10 statistics
```

### MTU for VLANs

A VLAN adds 4 bytes (the 802.1Q tag), so:

```bash
# The parent interface must support the increased MTU
set interfaces ethernet eth0 mtu 1504

# VLAN interface
set interfaces ethernet eth0 vif 10 mtu 1500

commit
```

## Common scenarios

### Scenario 1: Basic VLAN segmentation

**Requirements**:
- VLAN 10: Management (192.168.10.0/24)
- VLAN 20: Users (192.168.20.0/24)
- VLAN 30: Servers (192.168.30.0/24)
- VLAN 99: Guest (192.168.99.0/24)

**Configuration**:

```bash
# Parent interface (no IP, trunk only)
set interfaces ethernet eth0 description 'Trunk to Switch'

# VLAN 10 - Management
set interfaces ethernet eth0 vif 10 address 192.168.10.1/24
set interfaces ethernet eth0 vif 10 description 'Management'

# VLAN 20 - Users
set interfaces ethernet eth0 vif 20 address 192.168.20.1/24
set interfaces ethernet eth0 vif 20 description 'Users'

# VLAN 30 - Servers
set interfaces ethernet eth0 vif 30 address 192.168.30.1/24
set interfaces ethernet eth0 vif 30 description 'Servers'

# VLAN 99 - Guest
set interfaces ethernet eth0 vif 99 address 192.168.99.1/24
set interfaces ethernet eth0 vif 99 description 'Guest Network'

commit
save
```

### Scenario 2: VLAN with DHCP

A DHCP server for each VLAN:

```bash
# VLAN configuration
set interfaces ethernet eth1 vif 10 address 10.10.10.1/24
set interfaces ethernet eth1 vif 20 address 10.10.20.1/24

# DHCP for VLAN 10
set service dhcp-server shared-network-name VLAN10 subnet 10.10.10.0/24 option default-router 10.10.10.1
set service dhcp-server shared-network-name VLAN10 subnet 10.10.10.0/24 option name-server 10.10.10.1
set service dhcp-server shared-network-name VLAN10 subnet 10.10.10.0/24 range 0 start 10.10.10.100
set service dhcp-server shared-network-name VLAN10 subnet 10.10.10.0/24 range 0 stop 10.10.10.200
set service dhcp-server shared-network-name VLAN10 subnet 10.10.10.0/24 lease 86400

# DHCP for VLAN 20
set service dhcp-server shared-network-name VLAN20 subnet 10.10.20.0/24 option default-router 10.10.20.1
set service dhcp-server shared-network-name VLAN20 subnet 10.10.20.0/24 option name-server 10.10.20.1
set service dhcp-server shared-network-name VLAN20 subnet 10.10.20.0/24 range 0 start 10.10.20.100
set service dhcp-server shared-network-name VLAN20 subnet 10.10.20.0/24 range 0 stop 10.10.20.200

commit
save
```

### Scenario 3: Inter-VLAN Routing

Routing between VLANs:

```bash
# VLAN interfaces
set interfaces ethernet eth0 vif 10 address 172.16.10.1/24
set interfaces ethernet eth0 vif 20 address 172.16.20.1/24
set interfaces ethernet eth0 vif 30 address 172.16.30.1/24

# Inter-VLAN routing is enabled by default
# Firewall to control access between VLANs

# Allow VLAN 10 → VLAN 30 (management → servers)
set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 source address 172.16.10.0/24
set firewall ipv4 forward filter rule 100 destination address 172.16.30.0/24

# Allow VLAN 20 → VLAN 30 (users → servers, HTTP/HTTPS only)
set firewall ipv4 forward filter rule 110 action accept
set firewall ipv4 forward filter rule 110 source address 172.16.20.0/24
set firewall ipv4 forward filter rule 110 destination address 172.16.30.0/24
set firewall ipv4 forward filter rule 110 destination port 80,443
set firewall ipv4 forward filter rule 110 protocol tcp

# Block VLAN 20 → VLAN 10 (users cannot reach management)
set firewall ipv4 forward filter rule 120 action drop
set firewall ipv4 forward filter rule 120 source address 172.16.20.0/24
set firewall ipv4 forward filter rule 120 destination address 172.16.10.0/24

commit
save
```

### Scenario 4: VLAN on a Bond interface

VLAN on top of a bond (link aggregation):

```bash
# Bond interface
set interfaces bonding bond0 member interface eth0
set interfaces bonding bond0 member interface eth1
set interfaces bonding bond0 mode 802.3ad
set interfaces bonding bond0 description 'LACP to Switch'

# VLAN on the bond
set interfaces bonding bond0 vif 100 address 10.100.0.1/24
set interfaces bonding bond0 vif 100 description 'VLAN 100 on Bond'

set interfaces bonding bond0 vif 200 address 10.200.0.1/24
set interfaces bonding bond0 vif 200 description 'VLAN 200 on Bond'

commit
save
```

### Scenario 5: VLAN with NAT

NAT for VLANs (internet access):

```bash
# WAN interface
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'WAN'

# VLANs on the LAN
set interfaces ethernet eth1 vif 10 address 192.168.10.1/24
set interfaces ethernet eth1 vif 20 address 192.168.20.1/24

# NAT for VLAN 10
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.10.0/24
set nat source rule 100 translation address masquerade

# NAT for VLAN 20
set nat source rule 110 outbound-interface name eth0
set nat source rule 110 source address 192.168.20.0/24
set nat source rule 110 translation address masquerade

commit
save
```

## Advanced configurations

### QinQ (802.1ad) - VLAN Stacking

Double tagging for service providers:

```bash
# Outer VLAN (S-TAG)
set interfaces ethernet eth0 vif-s 100 description 'S-VLAN 100'

# Inner VLAN (C-TAG)
set interfaces ethernet eth0 vif-s 100 vif-c 10 address 10.100.10.1/24
set interfaces ethernet eth0 vif-s 100 vif-c 20 address 10.100.20.1/24

commit
```

**Structure**:
```
eth0
└── vif-s 100 (S-TAG, Outer VLAN)
    ├── vif-c 10 (C-TAG, Inner VLAN)
    └── vif-c 20 (C-TAG, Inner VLAN)
```

### VLAN with multiple IP addresses

```bash
# Primary IP
set interfaces ethernet eth0 vif 10 address 192.168.10.1/24

# Additional IPs on the same VLAN
set interfaces ethernet eth0 vif 10 address 192.168.10.2/24
set interfaces ethernet eth0 vif 10 address 192.168.10.3/24

commit
```

### VLAN with IPv6

```bash
# Dual-stack VLAN
set interfaces ethernet eth0 vif 10 address 192.168.10.1/24
set interfaces ethernet eth0 vif 10 address 2001:db8:10::1/64

# IPv6 SLAAC
set interfaces ethernet eth0 vif 10 ipv6 address autoconf

commit
```

### Private VLAN (PVLAN)

VyOS has no native PVLAN support, but it can be emulated with a firewall:

```bash
# VLAN 50 with host isolation
set interfaces ethernet eth0 vif 50 address 192.168.50.1/24

# Firewall: block hosts from reaching each other
set firewall ipv4 forward filter rule 500 action drop
set firewall ipv4 forward filter rule 500 source address 192.168.50.0/24
set firewall ipv4 forward filter rule 500 destination address 192.168.50.0/24

# Allow access to the gateway
set firewall ipv4 forward filter rule 501 action accept
set firewall ipv4 forward filter rule 501 destination address 192.168.50.1

commit
```

### VLAN with VRRP (High Availability)

```bash
# Router 1
set interfaces ethernet eth0 vif 10 address 192.168.10.2/24

set high-availability vrrp group VLAN10 vrid 10
set high-availability vrrp group VLAN10 interface eth0.10
set high-availability vrrp group VLAN10 address 192.168.10.1/24
set high-availability vrrp group VLAN10 priority 200

# Router 2
set interfaces ethernet eth0 vif 10 address 192.168.10.3/24

set high-availability vrrp group VLAN10 vrid 10
set high-availability vrrp group VLAN10 interface eth0.10
set high-availability vrrp group VLAN10 address 192.168.10.1/24
set high-availability vrrp group VLAN10 priority 100

commit
```

### VLAN with dynamic routing (OSPF)

```bash
# VLAN interfaces
set interfaces ethernet eth0 vif 10 address 10.0.10.1/24
set interfaces ethernet eth0 vif 20 address 10.0.20.1/24

# OSPF on the VLANs
set protocols ospf area 0 network 10.0.10.0/24
set protocols ospf area 0 network 10.0.20.0/24

# Or specifically on the interfaces
set protocols ospf interface eth0.10 area 0
set protocols ospf interface eth0.20 area 0

commit
```

### VLAN with bandwidth shaping

```bash
# VLAN interface
set interfaces ethernet eth0 vif 20 address 192.168.20.1/24

# Traffic policy (QoS)
set traffic-policy shaper VLAN20-LIMIT bandwidth 100mbit
set traffic-policy shaper VLAN20-LIMIT default bandwidth 80mbit

# Apply to the VLAN
set interfaces ethernet eth0 vif 20 traffic-policy out VLAN20-LIMIT

commit
```

## Firewall and security

### VLAN isolation

Full isolation of VLANs from each other:

```bash
# Block all inter-VLAN traffic
set firewall ipv4 forward filter default-action drop

# Allow only established/related
set firewall ipv4 forward filter rule 10 action accept
set firewall ipv4 forward filter rule 10 state established
set firewall ipv4 forward filter rule 10 state related

commit
```

### Selective access between VLANs

```bash
# VLAN 10: 192.168.10.0/24 (Admin)
# VLAN 20: 192.168.20.0/24 (Users)
# VLAN 30: 192.168.30.0/24 (Servers)

# Admin can reach everything
set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 source address 192.168.10.0/24

# Users → Servers (HTTP/HTTPS/DNS only)
set firewall ipv4 forward filter rule 110 action accept
set firewall ipv4 forward filter rule 110 source address 192.168.20.0/24
set firewall ipv4 forward filter rule 110 destination address 192.168.30.0/24
set firewall ipv4 forward filter rule 110 destination port 80,443,53
set firewall ipv4 forward filter rule 110 protocol tcp

# Servers → Users (deny)
set firewall ipv4 forward filter rule 120 action drop
set firewall ipv4 forward filter rule 120 source address 192.168.30.0/24
set firewall ipv4 forward filter rule 120 destination address 192.168.20.0/24

# Users → Admin (deny)
set firewall ipv4 forward filter rule 130 action drop
set firewall ipv4 forward filter rule 130 source address 192.168.20.0/24
set firewall ipv4 forward filter rule 130 destination address 192.168.10.0/24

commit
```

### Guest VLAN with restrictions

```bash
# Guest VLAN 99
set interfaces ethernet eth0 vif 99 address 192.168.99.1/24

# DHCP for guests
set service dhcp-server shared-network-name GUEST subnet 192.168.99.0/24 option default-router 192.168.99.1
set service dhcp-server shared-network-name GUEST subnet 192.168.99.0/24 option name-server 8.8.8.8
set service dhcp-server shared-network-name GUEST subnet 192.168.99.0/24 range 0 start 192.168.99.100
set service dhcp-server shared-network-name GUEST subnet 192.168.99.0/24 range 0 stop 192.168.99.200
set service dhcp-server shared-network-name GUEST subnet 192.168.99.0/24 lease 3600

# NAT for internet access
set nat source rule 990 outbound-interface name eth1
set nat source rule 990 source address 192.168.99.0/24
set nat source rule 990 translation address masquerade

# Firewall: internet only, block local networks
set firewall ipv4 forward filter rule 990 action drop
set firewall ipv4 forward filter rule 990 source address 192.168.99.0/24
set firewall ipv4 forward filter rule 990 destination address 192.168.0.0/16

set firewall ipv4 forward filter rule 991 action drop
set firewall ipv4 forward filter rule 991 source address 192.168.99.0/24
set firewall ipv4 forward filter rule 991 destination address 10.0.0.0/8

set firewall ipv4 forward filter rule 992 action drop
set firewall ipv4 forward filter rule 992 source address 192.168.99.0/24
set firewall ipv4 forward filter rule 992 destination address 172.16.0.0/12

# Allow internet (everything else)
set firewall ipv4 forward filter rule 999 action accept
set firewall ipv4 forward filter rule 999 source address 192.168.99.0/24

commit
```

## Monitoring and diagnostics

### Checking VLAN interfaces

```bash
# List all VLANs
show interfaces

# VLAN interface details
show interfaces ethernet eth0 vif 10

# Statistics
show interfaces ethernet eth0 vif 10 statistics

# Packets
show interfaces ethernet eth0 vif 10 statistics
```

### VLAN tagging verification

```bash
# tcpdump on the parent interface (VLAN tags are visible)
sudo tcpdump -i eth0 -e -n

# tcpdump on the VLAN interface (no tags)
sudo tcpdump -i eth0.10 -n

# Show VLAN tagged packets
sudo tcpdump -i eth0 'vlan'

# A specific VLAN
sudo tcpdump -i eth0 'vlan 10'
```

### Connectivity checks

```bash
# Ping with source
ping 192.168.20.10 source-address 192.168.10.1

# Traceroute
traceroute 192.168.30.10

# Check MAC addresses
show arp interface eth0.10
```

### Checking the VLAN table

```bash
# On the parent interface
cat /proc/net/vlan/eth0.10

# Kernel VLAN table
cat /proc/net/vlan/config
```

Output:
```
VLAN Dev name    | VLAN ID
Name-Type: VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD
eth0.10        | 10  | eth0
eth0.20        | 20  | eth0
eth0.30        | 30  | eth0
```

## Troubleshooting

### VLAN interface does not come up

**Problem**: The VLAN interface is in the down state.

**Causes**:
1. The parent interface is down
2. The VLAN is not configured on the switch
3. Incorrect VLAN ID

**Diagnostics**:
```bash
# Check the parent
show interfaces ethernet eth0

# Check the VLAN
show interfaces ethernet eth0 vif 10

# Kernel messages
dmesg | grep eth0
```

**Solution**:
```bash
# Make sure the parent interface is up
set interfaces ethernet eth0 disable false

# Verify the VLAN configuration on the switch
```

### No connectivity between VLANs

**Problem**: Devices in different VLANs cannot communicate.

**Causes**:
1. Inter-VLAN routing is not working
2. The firewall is blocking traffic
3. Incorrect default gateway on the clients

**Diagnostics**:
```bash
# Check routing
show ip route

# Check the firewall
show firewall ipv4 forward filter

# Ping with source
ping 192.168.20.10 source-address 192.168.10.1
```

**Solution**:
```bash
# Verify that IP forwarding is enabled (enabled by default)
cat /proc/sys/net/ipv4/ip_forward
# Should be 1

# Check the firewall rules
show firewall ipv4 forward filter

# Add a rule if needed
set firewall ipv4 forward filter rule 100 action accept
```

### VLAN traffic is not tagged

**Problem**: Traffic on the switch has no VLAN tags.

**Causes**:
1. The switch port is in access mode instead of trunk
2. Native VLAN mismatch

**Solution**:
On the switch (Cisco example):
```
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
```

### MTU issues with VLANs

**Problem**: Packets are fragmented or lost.

**Cause**: A VLAN adds 4 bytes, but the MTU does not account for it.

**Solution**:
```bash
# Increase the MTU on the parent
set interfaces ethernet eth0 mtu 1504

# Or decrease it on the VLAN
set interfaces ethernet eth0 vif 10 mtu 1496

commit
```

### Broadcast storm in a VLAN

**Problem**: High CPU load, the network is slow.

**Causes**:
1. A loop in the network
2. No STP
3. Broadcast traffic

**Diagnostics**:
```bash
# Watch broadcast packets
sudo tcpdump -i eth0.10 broadcast -c 100

# Error statistics
show interfaces ethernet eth0 vif 10 statistics
```

**Solution**:
1. Enable STP on the switches
2. Check the topology for loops
3. Limit broadcast traffic (storm-control on the switch)

## Integration with switches

### Cisco IOS

```cisco
! Trunk port to VyOS
interface GigabitEthernet0/1
 description Trunk to VyOS
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
 switchport trunk native vlan 999
 spanning-tree portfast trunk
```

### HP/Aruba

```
! Trunk to VyOS
interface 1
 name "Trunk to VyOS"
 tagged vlan 10,20,30,99
 untagged vlan 999
```

### Mikrotik

```
# VLANs on a bridge
/interface vlan
add interface=bridge1 name=vlan10 vlan-id=10
add interface=bridge1 name=vlan20 vlan-id=20

# Trunk port
/interface bridge port
add bridge=bridge1 interface=ether1 comment="Trunk to VyOS"

# VLAN filtering
/interface bridge vlan
add bridge=bridge1 tagged=ether1 vlan-ids=10,20,30
```

### Linux Bridge

```bash
# VLAN on a Linux server
ip link add link eth0 name eth0.10 type vlan id 10
ip addr add 192.168.10.100/24 dev eth0.10
ip link set eth0.10 up
```

## Real-world configuration examples

### Example 1: Small office (SOHO)

**Topology**:
- VLAN 10: Management (192.168.10.0/24)
- VLAN 20: Office (192.168.20.0/24)
- VLAN 30: WiFi (192.168.30.0/24)

```bash
# WAN
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'Internet'

# LAN trunk
set interfaces ethernet eth1 description 'LAN Trunk'

# Management VLAN
set interfaces ethernet eth1 vif 10 address 192.168.10.1/24
set interfaces ethernet eth1 vif 10 description 'Management'

# Office VLAN
set interfaces ethernet eth1 vif 20 address 192.168.20.1/24
set interfaces ethernet eth1 vif 20 description 'Office Network'

# WiFi VLAN
set interfaces ethernet eth1 vif 30 address 192.168.30.1/24
set interfaces ethernet eth1 vif 30 description 'WiFi'

# DHCP for all VLANs
set service dhcp-server shared-network-name MGMT subnet 192.168.10.0/24 option default-router 192.168.10.1
set service dhcp-server shared-network-name MGMT subnet 192.168.10.0/24 range 0 start 192.168.10.100
set service dhcp-server shared-network-name MGMT subnet 192.168.10.0/24 range 0 stop 192.168.10.200

set service dhcp-server shared-network-name OFFICE subnet 192.168.20.0/24 option default-router 192.168.20.1
set service dhcp-server shared-network-name OFFICE subnet 192.168.20.0/24 range 0 start 192.168.20.100
set service dhcp-server shared-network-name OFFICE subnet 192.168.20.0/24 range 0 stop 192.168.20.200

set service dhcp-server shared-network-name WIFI subnet 192.168.30.0/24 option default-router 192.168.30.1
set service dhcp-server shared-network-name WIFI subnet 192.168.30.0/24 range 0 start 192.168.30.100
set service dhcp-server shared-network-name WIFI subnet 192.168.30.0/24 range 0 stop 192.168.30.200

# NAT for all
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.0.0/16
set nat source rule 100 translation address masquerade

# Firewall: WiFi isolated from local networks
set firewall ipv4 forward filter rule 300 action drop
set firewall ipv4 forward filter rule 300 source address 192.168.30.0/24
set firewall ipv4 forward filter rule 300 destination address 192.168.10.0/24

set firewall ipv4 forward filter rule 301 action drop
set firewall ipv4 forward filter rule 301 source address 192.168.30.0/24
set firewall ipv4 forward filter rule 301 destination address 192.168.20.0/24

commit
save
```

### Example 2: Enterprise with many VLANs

**Topology**:
- VLAN 10: Management
- VLAN 20: Employees
- VLAN 30: Servers
- VLAN 40: VoIP
- VLAN 50: CCTV
- VLAN 99: Guest

```bash
# Trunk interface
set interfaces ethernet eth0 description 'Core Switch Trunk'
set interfaces ethernet eth0 mtu 1600

# Management
set interfaces ethernet eth0 vif 10 address 10.0.10.1/24
set interfaces ethernet eth0 vif 10 description 'Management VLAN'

# Employees
set interfaces ethernet eth0 vif 20 address 10.0.20.1/24
set interfaces ethernet eth0 vif 20 description 'Employees'

# Servers
set interfaces ethernet eth0 vif 30 address 10.0.30.1/24
set interfaces ethernet eth0 vif 30 description 'Servers'

# VoIP
set interfaces ethernet eth0 vif 40 address 10.0.40.1/24
set interfaces ethernet eth0 vif 40 description 'VoIP'

# CCTV
set interfaces ethernet eth0 vif 50 address 10.0.50.1/24
set interfaces ethernet eth0 vif 50 description 'CCTV'

# Guest
set interfaces ethernet eth0 vif 99 address 10.0.99.1/24
set interfaces ethernet eth0 vif 99 description 'Guest WiFi'

# QoS for the VoIP VLAN
set traffic-policy shaper VOIP bandwidth 100mbit
set traffic-policy shaper VOIP default bandwidth 100mbit
set traffic-policy shaper VOIP default priority 7
set interfaces ethernet eth0 vif 40 traffic-policy out VOIP

# Firewall access matrix
# Management → All
set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 source address 10.0.10.0/24

# Employees → Servers (limited ports)
set firewall ipv4 forward filter rule 110 action accept
set firewall ipv4 forward filter rule 110 source address 10.0.20.0/24
set firewall ipv4 forward filter rule 110 destination address 10.0.30.0/24
set firewall ipv4 forward filter rule 110 destination port 80,443,3389
set firewall ipv4 forward filter rule 110 protocol tcp

# VoIP isolated (only to servers for call control)
set firewall ipv4 forward filter rule 140 action accept
set firewall ipv4 forward filter rule 140 source address 10.0.40.0/24
set firewall ipv4 forward filter rule 140 destination address 10.0.30.100
set firewall ipv4 forward filter rule 140 destination port 5060,5061
set firewall ipv4 forward filter rule 140 protocol udp

# CCTV isolated (only to NVR server)
set firewall ipv4 forward filter rule 150 action accept
set firewall ipv4 forward filter rule 150 source address 10.0.50.0/24
set firewall ipv4 forward filter rule 150 destination address 10.0.30.200

# Guest fully isolated
set firewall ipv4 forward filter rule 190 action drop
set firewall ipv4 forward filter rule 190 source address 10.0.99.0/24
set firewall ipv4 forward filter rule 190 destination address 10.0.0.0/8

commit
save
```

## Best practices

1. **VLAN ID planning**:
   - Use a logical scheme (10-19 management, 20-29 users, etc.)
   - Document VLAN IDs and their purpose
   - Reserve ranges for future growth

2. **MTU configuration**:
   - Parent interface: MTU 1504 or higher
   - VLAN interface: MTU 1500
   - Jumbo frames: account for the extra 4 bytes

3. **Interface descriptions**:
   - Always add a description for a VLAN
   - Specify the purpose and contact information

4. **Security**:
   - Use a firewall to control inter-VLAN routing
   - Isolate guest networks
   - Limit broadcast traffic

5. **DHCP configuration**:
   - Separate DHCP pools for each VLAN
   - Use DHCP options (DNS, NTP, domain)
   - Configure DHCP snooping on the switches

6. **QoS for critical VLANs**:
   - The VoIP VLAN should have priority
   - Real-time traffic (video) requires guaranteed bandwidth

7. **Monitoring**:
   - Track the state of VLAN interfaces
   - Log VLAN changes
   - Alert on the down state

8. **Configuration backup**:
   - Save the configuration regularly
   - Document the VLAN topology
   - Keep network diagrams

9. **Native VLAN**:
   - Do not use VLAN 1 as the native VLAN
   - Use an unused VLAN as the native one (for example, 999)
   - Ensure native VLAN consistency across all trunk ports

10. **Testing**:
    - Test connectivity between VLANs
    - Verify firewall rules
    - Verify QoS policies
    - Test failover if redundancy is present

## Conclusion

VLANs in VyOS provide a flexible and powerful mechanism for network segmentation. Proper use of VLANs allows you to:
- Improve security through isolation
- Optimize network performance
- Simplify management and scaling
- Implement QoS for critical services

VyOS supports all modern VLAN features, including 802.1Q tagging, QinQ (802.1ad), VLAN on bond interfaces, and full integration with firewall, NAT, routing, and QoS.