In this lesson, you will learn how to logically segment your network traffic at the data link layer by implementing 802.1Q encapsulation on Linux interfaces.
The Concept of VLAN Tagging
On a standard physical network interface, all traffic is treated as part of a single broadcast domain. By using IEEE 802.1Q, we can insert a 4-byte "tag" into the Ethernet frame header. This tag includes a VLAN ID (VID) between 1 and 4094, allowing the kernel to distinguish between traffic streams. Even if multiple virtual segments share the same physical wire, the operating system treats them as isolated, independent interfaces.
Trunking in Linux
Trunking occurs when you configure a single physical interface—often called a "trunk port"—to carry traffic for multiple VLANs simultaneously. In the Linux kernel, this is achieved by creating "VLAN devices" (sub-interfaces) attached to a physical parent interface.
For example, if you want to route traffic for VLAN 10 over eth0, the kernel handles the tagging/untagging process transparently. When a packet leaves the host for VLAN 10, the kernel adds the tag; when a tagged packet arrives, the kernel strips the tag and directs it to the appropriate virtual interface.
Implementation Example
You can configure these interfaces using the ip command suite. To create a virtual interface for VLAN 10 on eth0:
# Create the VLAN interface (eth0.10) for VLAN ID 10
ip link add link eth0 name eth0.10 type vlan id 10
# Bring the interface up
ip link set dev eth0.10 up
Once this is configured, eth0.10 acts as a distinct network device. You can assign it an IP address, apply iptables rules, or attach it to a bridge, all while the underlying eth0 physical interface remains responsible for the raw transmission of the tagged frames. This logical separation is crucial for multi-tenant environments where you must ensure traffic isolation at Layer 2 without requiring separate physical cables for every network segment.
Key Takeaway: VLAN tagging uses 802.1Q headers to partition a single physical link into multiple isolated broadcast domains, allowing Linux to manage distinct virtual network interfaces on shared hardware.