Connecting servers to a VLAN
This guide explains how to configure VLANs on Linux servers to isolate and control network traffic. The steps below cover Ubuntu 22.04, Debian 11, and AlmaLinux 9 / Rocky Linux 9.
Before configuring VLANs on the server, ensure the switch port is configured correctly. For tagged VLANs, the switch port must allow the required VLAN IDs. For untagged traffic, the port must be in access mode with the appropriate VLAN assigned.
Verify the 8021q kernel module
On all distributions, verify that the 8021q kernel module is loaded before configuring VLANs:
lsmod | grep 8021q
If the module is not loaded, run:
sudo modprobe 8021q
To make it permanent, add the module to /etc/modules:
echo "8021q" | sudo tee -a /etc/modules
Ubuntu 22.04
Ubuntu 22.04 uses netplan for network configuration.
Identify the network interface
Run the following command to find the interface name:
ip link show
In the examples below, the interface is enp0s8.
Configure networking for an untagged access port
This section covers assigning a static IP address directly to the physical interface, without creating a VLAN sub-interface.
Open the netplan configuration file:
sudo nano /etc/netplan/*.yaml
Add the following configuration. Use different IP addresses on each server:
Server 1:
network: version: 2 ethernets: enp0s8: dhcp4: no addresses: - 192.168.1.1/24 routes: - to: default via: 192.168.1.254
Server 2:
network: version: 2 ethernets: enp0s8: dhcp4: no addresses: - 192.168.1.2/24 routes: - to: default via: 192.168.1.254
The gateway4 parameter has been deprecated since netplan 0.100 and will produce a warning. Use routes: as shown above.
Test the configuration before applying it. The command waits up to 120 seconds for confirmation, then reverts automatically if not confirmed — useful on remote servers:
sudo netplan try
If the configuration is valid, apply it:
sudo netplan apply
Verify that the address has been assigned:
ip addr show enp0s8
Configure tagged VLANs
Open the netplan configuration file and add the VLAN interfaces. Use different IP addresses for each server on each VLAN:
Server 1:
network: version: 2 ethernets: enp0s8: dhcp4: no vlans: vlan10: id: 10 link: enp0s8 addresses: - 192.168.10.1/24 vlan20: id: 20 link: enp0s8 addresses: - 192.168.20.1/24
Server 2:
network: version: 2 ethernets: enp0s8: dhcp4: no vlans: vlan10: id: 10 link: enp0s8 addresses: - 192.168.10.2/24 vlan20: id: 20 link: enp0s8 addresses: - 192.168.20.2/24
Using duplicate IP addresses will cause a conflict. Each server must have a unique IP address on each VLAN.
Only one VLAN interface should normally have a default gateway. Assigning a gateway on multiple VLAN interfaces may cause routing issues unless advanced routing is configured.
Test and apply the configuration:
sudo netplan try sudo netplan apply
Verify the result:
ip addr
To verify that VLAN tagging is working correctly:
ip -d link show vlan10 ip -d link show vlan20
Check connectivity:
ping 192.168.10.2 ping 192.168.20.2
Debian 11
Debian 11 uses the /etc/network/interfaces file for network configuration.
Install the vlan package
On a clean Debian installation, install the vlan package before configuring VLAN interfaces:
sudo apt update sudo apt install vlan
Identify the network interface
ip link show
In the examples below, the interface is enp0s8.
Configure networking for an untagged access port
This section covers assigning a static IP address directly to the physical interface, without creating a VLAN sub-interface.
Add the following to /etc/network/interfaces on each server.
The ip addr add command assigns an address temporarily and will not survive a reboot. Use the persistent configuration below to make it permanent.
Server 1:
auto enp0s8 iface enp0s8 inet static address 192.168.1.1/24 gateway 192.168.1.254
Server 2:
auto enp0s8 iface enp0s8 inet static address 192.168.1.2/24 gateway 192.168.1.254
Apply the configuration without rebooting:
sudo systemctl restart networking
Verify that the address is active:
ip addr
Check that the servers can reach each other:
ping 192.168.1.2
Configure tagged VLANs
Add the VLAN interfaces to /etc/network/interfaces on each server. Use different IP addresses for each server on each VLAN.
Server 1:
auto enp0s8.10 iface enp0s8.10 inet static address 192.168.10.1/24 gateway 192.168.10.254 auto enp0s8.20 iface enp0s8.20 inet static address 192.168.20.1/24
Server 2:
auto enp0s8.10 iface enp0s8.10 inet static address 192.168.10.2/24 gateway 192.168.10.254 auto enp0s8.20 iface enp0s8.20 inet static address 192.168.20.2/24
Apply the configuration:
Restarting the networking service on a remote server may interrupt the current SSH session.
sudo systemctl restart networking
Verify the result:
ip addr
To verify that VLAN tagging is working correctly:
ip -d link show enp0s8.10 ip -d link show enp0s8.20
Check connectivity:
ping 192.168.10.2 ping 192.168.20.2
AlmaLinux 9 / Rocky Linux 9
AlmaLinux 9 and Rocky Linux 9 use NetworkManager for network configuration. The recommended tool for managing connections is nmcli. The legacy /etc/sysconfig/network-scripts/ approach is not supported in RHEL 9-based distributions.
Identify the network interface
nmcli device status
In the examples below, the interface is enp0s8.
Check for existing connections
Before adding a new connection, check whether a connection profile already exists for the interface:
nmcli connection show
If an existing profile is active on enp0s8, remove it to avoid conflicts. Use the profile name exactly as shown in the output above. Skip this step if the existing profile was created by your hosting provider or cloud-init:
nmcli connection delete "Wired connection 1"
Configure networking for an untagged access port
Assign a static IP address to the physical interface.
Server 1:
nmcli connection add type ethernet con-name "enp0s8-primary" ifname enp0s8 \ ipv4.method manual ipv4.addresses 192.168.1.1/24 \ ipv4.gateway 192.168.1.254 \ connection.autoconnect yes nmcli connection up enp0s8-primary
Server 2:
nmcli connection add type ethernet con-name "enp0s8-primary" ifname enp0s8 \ ipv4.method manual ipv4.addresses 192.168.1.2/24 \ ipv4.gateway 192.168.1.254 \ connection.autoconnect yes nmcli connection up enp0s8-primary
Verify that the address has been assigned:
ip addr show enp0s8
Check connectivity between the servers:
ping 192.168.1.2
Configure tagged VLANs
Create a VLAN interface on top of the physical interface. Use different IP addresses on each server for each VLAN.
Server 1:
nmcli connection add type vlan con-name vlan10 ifname enp0s8.10 \ vlan.parent enp0s8 vlan.id 10 \ ipv4.method manual ipv4.addresses 192.168.10.1/24 \ connection.autoconnect yes nmcli connection add type vlan con-name vlan20 ifname enp0s8.20 vlan.parent enp0s8 vlan.id 20 ipv4.method manual ipv4.addresses 192.168.20.1/24 connection.autoconnect yes nmcli connection up vlan10 nmcli connection up vlan20
Server 2:
nmcli connection add type vlan con-name vlan10 ifname enp0s8.10 \ vlan.parent enp0s8 vlan.id 10 \ ipv4.method manual ipv4.addresses 192.168.10.2/24 \ connection.autoconnect yes nmcli connection add type vlan con-name vlan20 ifname enp0s8.20 vlan.parent enp0s8 vlan.id 20 ipv4.method manual ipv4.addresses 192.168.20.2/24 connection.autoconnect yes nmcli connection up vlan10 nmcli connection up vlan20
Using duplicate IP addresses will cause a conflict. Each server must have a unique IP address on each VLAN.
Verify the result:
ip addr
To verify that VLAN tagging is working correctly:
ip -d link show enp0s8.10 ip -d link show enp0s8.20
Check connectivity:
ping 192.168.10.2 ping 192.168.20.2
Troubleshooting
If VLAN interfaces do not appear or do not receive traffic:
- verify that the switch port allows the required VLAN IDs;
- confirm that the hypervisor vSwitch or port group is configured to pass VLAN tags;
- ensure the correct parent interface is specified in the configuration;
- verify that the 8021q kernel module is loaded: lsmod | grep 8021q.
