This project tries to ease the use of vlan tagging with linux bridges on libvirt. The idea and parts of my work are based on the great work of Ingo on serverfault.
Install the qemu-script to /etc/libvirt/hooks/ and make it executable. Do the same for vlan-config.py.
mkdir /etc/libvirt/hooks/
cp qemu vlan-config.py /etc/libvirt/hooks/
chmod +x /etc/libvirt/hooks/{qemu,vlan-config.py}Now libvirtd needs to be restarted to use the qemu script on vm start.
systemctl restart libvirtdThe qemu hook will log to /var/log/libvirt/qemu/.
To be able to set and foward VLAN tags you'll need a bridge that allows vlan_filtering and a bridge slave where the vid tags can egress.
$ nmcli con sh bridge0
connection.id: bridge0
connection.uuid: 95e4d2bb-01c0-499b-bdc1-570da5df1af4
connection.stable-id: --
connection.type: bridge
connection.interface-name: bridge0
bridge.vlan-filtering: ja # Important to turn on
bridge.vlan-default-pvid: 1 # Sets the default VLAN for the bridge0 interface
bridge.vlans: 2-10 # Sets all allowed VLANs except pvid for bridge0 interface$ nmcli con sh eno1
connection.id: eno1
connection.uuid: 8255f4e3-add6-4097-9c3d-6f20e54b5008
connection.stable-id: --
connection.type: 802-3-ethernet
connection.interface-name: eno1
connection.master: bridge0
connection.slave-type: bridge
bridge-port.priority: 32
bridge-port.path-cost: 100
bridge-port.hairpin-mode: nein
bridge-port.vlans: 1 pvid untagged, 2-10 # Sets the default vid that egress will have and the allowed vidsTo verify your vlan configuration you'll need to use the bridge command:
$ bridge vlan show
port vlan-id
eno1 1 PVID Egress Untagged
2
3
4
5
6
7
8
9
10
bridge0 1 PVID Egress Untagged
2
3
4
5
6
7
8
9
10
.
.
.
vnet31 38
50 PVID Egress Untagged
51Have a look into example.xml. It's an example on how vlans get configured.
You need to add metadata information to the VM in order for the script to pick up the vlan ids. It should look something like this:
<metadata xmlns:ns0="https://github.com/modzilla99/libvirt-vlans">
<ns0:vlanconfig>
<ns0:iface pvid="1">
<ns0:vlan untagged="yes">1</ns0:vlan>
<ns0:vlan untagged="no">10</ns0:vlan>
<ns0:vlan untagged="no">11</ns0:vlan>
</ns0:iface>
<ns0:iface pvid="13">
<ns0:vlan untagged="no">1</ns0:vlan>
<ns0:vlan untagged="no">10</ns0:vlan>
<ns0:vlan untagged="yes">13</ns0:vlan>
<ns0:vlan untagged="no">14-51</ns0:vlan>
</ns0:iface>
</ns0:vlanconfig>
</metadata>To test whether your metadata edits have worked use the following command:
virsh metadata ${VMName} https://github.com/modzilla99/libvirt-vlansThe output should look something like this:
<vlanconfig>
<iface pvid="1">
<vlan untagged="yes">1</vlan>
<vlan untagged="no">10-50</vlan>
</iface>
<iface pvid="50">
<vlan untagged="no">38</vlan>
<vlan untagged="yes">50</vlan>
<vlan untagged="no">51</vlan>
</iface>
</vlanconfig>
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent