I’ve had some free time and a desire to break stuff on my network at home. I wanted to fix my home network’s topology to more correctly split up my wired (DHCP), wireless (DHCP) and server (statically-configured) subnets. At a high level, I had to create a server subnet, create vlan’s on my layer-3 switch for each of those pervious subnets, then I had to move the network interfaces on my VM host around to only connect to the networks I wanted it to (wired and server).
First, I moved the secondary interface of my VM host at home from the wifi network to the new server network. The server network would have its own subnet (10.10.2.0/24) and its own VLAN, Vlan 12. (we all have Layer3 managed-switches at home, right?).
The fw/router on my network runs OpenBSD. Interface ’em3’ will be providing connectivity to vlan 12.
$ cat /etc/hostname.em3 up description “Server Iface” $ cat /etc/hostname.vlan12 inet 10.10.2.1 255.255.255.0 10.10.2.255 vlan 12 vlandev em3 description “Server Network vlan12”
Depending on if I want to throw more VLAN’s on em3, I can just create more hostname.vlan{number} files with appropriate network configuration.
The switch managing my network’s traffic is an HP 2910al-24G (J9145). The relevant configuration to handle tagged packets on vlan-12 on two ports (4, 12) is:
vlan 12 name “Servers-10-10-2-0-24” tagged 4,12 ip address 10.10.2.15 255.255.255.0 exit
I’ve also added a management IP on this server subnet VLAN as well. On my VM host, this took me the most time to get right. The hardware network interface for the server network is eth1. I wanted to create a bridge on this interface so that multiple VM’s could use this interface to bind to. This bridged interface on vlan-12 is br-vlan12. This host also has an IP address on the network itself so that I can access the VM host itself over the server subnet.
auto eth1 iface eth1 inet manual auto br-vlan12 iface br-vlan12 inet static address 10.10.2.21 network 10.10.2.0 netmask 255.255.255.0 broadcast 10.10.2.255 bridge_ports eth1.12 bridge_stp off
One of the pieces that had me fumbling for so long is getting the bridge_ports and vlan_raw_interfaces specification on the bridge. It turns out when the former is specified in a certain way, the latter is not needed.
From interfaces(5):
VLAN AND BRIDGE INTERFACES To ease the configuration of VLAN interfaces, interfaces having . (full stop character) in the name are configured as 802.1q tagged virtual LAN interface. For exam‐ ple, interface eth0.1 is a virtual interface having eth0 as physical link, with VLAN ID 1. For compatibility with bridge-utils package, if bridge_ports option is specified, VLAN interface configuration is not performed.
I am still having some fun issues with routing on my network, where I can ping from my wifi network to the wired-network interface on my LAN, but not wifi -> server. I think this has to do with reverse path forwarding (RPF) checking on the server, given its default route is over the ‘wired’ network and not the server network interface. An invaluable tool to debugging these types of issues has been the sysctl setting below, logging martians. It logs instances where packets come into an interface which it does not expect, and therefore by-default rejects.
net.ipv4.conf.all.log_martians = 1
The fun and breakage continues.
Helpful links found during my foray into this topic: