Setup VLAN-tagged interface on Ubuntu

VLANs offer a powerful way to divide a physical network into multiple logical networks. This can be useful if your host has a limited number of interfaces or you want to limit the usage of network ports on your switch. In this tutorial, we’ll demonstrate how to set up a VLAN-tagged interfaces on top of physical network interface on Ubuntu 22.04 using NetworkManager Text User Interface (nmtui).

Our host physical interface enp1s0 is connected to a trunk port on the switch with three tagged VLANs: VLAN 1, VLAN 2 and VLAN 3.

The network configuration on the host is managed by the NetworkManager, what is stated in the netplan config:

root@tuxfixer:~# cat /etc/netplan/01-network-manager-all.yaml
# Let NetworkManager manage all devices on this system
network:
  version: 2
  renderer: NetworkManager

The NetworkManager service is enabled and running:

root@tuxfixer:~# systemctl status NetworkManager
● NetworkManager.service - Network Manager
     Loaded: loaded (/lib/systemd/system/NetworkManager.service; enabled; vendor preset: enabled)
     Active: active (running) since Fri 2024-11-15 11:59:04 CET; 2h 13min ago
       Docs: man:NetworkManager(8)
   Main PID: 716 (NetworkManager)
      Tasks: 3 (limit: 9308)
     Memory: 11.9M
        CPU: 2.271s
     CGroup: /system.slice/NetworkManager.service
             └─716 /usr/sbin/NetworkManager --no-daemon
...

Launch NetworkManager TUI:

root@tuxfixer:~# nmtui

Now select Edit a connection option:

Edit a physcial interface enp1s0 configuration:

Disable any IP configuration on physical enp1s0 interface:

Add a new VLAN connection:

Now create a tagged interface for VLAN 1, based on the physical enp1s0 interface, that is, the enp1s0.1 interface, and assign an IP address, along with netmask prefix, gateway, and DNS servers. This interface will be used for the default routing, that’s why we are setting gateway here:

Now add another VLAN connection, and create a tagged interface enp1s0.2 for VLAN 2. For this interface we are not setting any gateway or DNS servers, because it will not be used for a default route:

Finally, add the third VLAN connection, and create a tagged interface enp1s0.3 for VLAN 3. This interface will not be used for a default route, so we are not setting any gateway or DNS servers here:

Our final setup looks like below – based on the physical enp1s0 interface we have created three VLAN interfaces: enp1s0.1, enp1s0.2 and enp1s0.3 for VLAN ids: 1, 2 and 3:

The same setup presented using the ip command:

root@tuxfixer:~# ip a
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp1s0:  mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether fc:aa:14:2b:5a:ba brd ff:ff:ff:ff:ff:ff
3: enp2s0:  mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether fc:aa:14:2b:5a:b8 brd ff:ff:ff:ff:ff:ff
4: enp1s0.3@enp1s0:  mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether fc:aa:14:2b:5a:ba brd ff:ff:ff:ff:ff:ff
    inet 192.168.4.1/24 brd 192.168.4.255 scope global noprefixroute enp1s0.3
       valid_lft forever preferred_lft forever
5: enp1s0.1@enp1s0:  mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether fc:aa:14:2b:5a:ba brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.8/24 brd 192.168.2.255 scope global noprefixroute enp1s0.1
       valid_lft forever preferred_lft forever
6: enp1s0.2@enp1s0:  mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether fc:aa:14:2b:5a:ba brd ff:ff:ff:ff:ff:ff
    inet 192.168.3.1/24 brd 192.168.3.255 scope global noprefixroute enp1s0.2
       valid_lft forever preferred_lft forever

The default routing goes via enp1s0.1 interface, as intended:

root@tuxfixer:~# ip route show
default via 192.168.2.1 dev enp1s0.1 proto static metric 400 
169.254.0.0/16 dev enp1s0 scope link metric 1000 
192.168.2.0/24 dev enp1s0.1 proto kernel scope link src 192.168.2.8 metric 400 
192.168.3.0/24 dev enp1s0.2 proto kernel scope link src 192.168.3.1 metric 401 
192.168.4.0/24 dev enp1s0.3 proto kernel scope link src 192.168.4.1 metric 402