vlanfilter - can it be used in /etc/rc.conf?

vmb

vmb

Reference: https://people.freebsd.org/~ivy/bridge_vlan_filtering.txt

I am trying to get a jail host working with VLANs that are present on it's physical network to be selectively available to vnet jails.
E.g
Jail host has one IP address assigned via DHCP from the untagged 'vlan1'
Jails on this host can belong to one of two other tagged VLANS, 'vlan2, vlan3'
Jails are assigned static IP addresses and cannot be members of 'vlan1'.

It appears that FreeBSD 15 vlanfilter only works when entered from the command line or when scripted. I cannot find any documentation on how to use vlanfilter in /etc/rc.conf

I assume that processing FreeBSD 15 VLAN filtering bridges from /etc/rc.conf has yet to be implemented and only pre-15 bridge per VLAN configuration can currently be processed in 15.x . Am I correct with this assumption?

If FreeBSD 15.x /etc/rc.conf can process vlanfilter bridge configurations, can you point me to some proven to work documentation for /etc/rc.conf .
 
vmb said:
If FreeBSD 15.x /etc/rc.conf can process vlanfilter bridge configurations, can you point me to some proven to work documentation for /etc/rc.conf .
Click to expand...
rc.conf(5) create_args_(interface) is what you are looking for.

Example /etc/rc.conf configuration:
Code: 
cloned_interfaces="bridge0"
ifconfig_bridge0="inet 10.0.0.1/24 up"
create_args_bridge0="vlanfilter"

Rich (BB code): 
 # ifconfig bridge0
bridge0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        options=10<VLAN_HWTAGGING>
        ether 58:9c:fc:10:23:1a
        inet 10.0.0.1 netmask 0xffffff00 broadcast 10.0.0.255
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        bridge flags=1<VLANFILTER>
        groups: bridge
        nd6 options=9<PERFORMNUD,IFDISABLED>
 
Thanks. I have used create_args before with vlan numbers but I didn't think to using it with vlanfilter. I will try that now.
 
Using create_args did indeed activate the vlanfilter. However, for every configuration I tried it knocked out the ability to locate the default gateway despite netstat-r showing the default gateway was present in each case.

It would be nice to see a complete configuration that was used to test the release build of vlanfilter on FreeBSD 15.x . I would rather recreate a proven working configuration then adapt it to my needs than write one from scratch using information that I don't know is complete, still relevant, or just plain wrong.

I don't have any more time to mess about this. I have wasted a day already. I am just going to separate the two sets of jails, migrating one set to another jail host. Each jail host then has a dedicated untagged VLAN with IP assigned to their bridge0 and all vnet jails using the same VLAN that the host is using.
 
You must log in or register to reply here.
Back
Top