vlan
Virtual Local Area Networks are used to divide a physical network into several broadcast domains.
Introduction
As you probably already understand, the reason to use VLANs is to divide a network and separate hosts that shouldn't be able to access each other. This article will address the IEEE 802.1q standard way of doing this division.
There are two types of packets on a VLAN, these are tagged and untagged packets. The untagged packet is a regular packet and looks just like a packet that exists on a regular network. Untagged packets are the most common type on a VLAN. The decision of which VLAN an untagged packet belongs to is made by the switch. A switch can be configured to assign specific ports to specific VLANs. The switch can also be configured to receive tagged packets.
If the switch receives a tagged packet and the port which it receives the packet with is configured to allow tagged packets, it knows which ports it can send the packet to.
A switch can also be configured to transmit tagged packets, this could be used to make a VLAN span more than one switch or to make use of a VLAN aware NIC (Network Interface Card) on a router, firewall, server or even a workstation.
A VLAN is assigned a specific id. This id can be anything between 1 and 4094. VLAN 1 is most commonly used for management so this should not be used.
Prerequisites
Variables needed to make use of VLANs. 
Hardware
To be able to make use of VLANs you will need a switch (or several) that support the IEEE 802.1q standard. You will also need a NIC (Network Interface Card) that plays nice when used to transmit and receive tagged packets. Many NICs do support 802.1q but some have trouble with the extra 4 bytes added to the packet when tagged packets are used.
Software
Ubuntu supports VLANs out of the box but a userspace tool needs to be installed to create the VLAN aware interfaces.
Scenario
We have a router/firewall with two NICs one used to connect to the Internet (WAN) and the other to connect to the local network (LAN). We would like to beef up the security aspect of our site and introduce a Demilitarized Zone (DMZ). If this should be implemented without the use of VLANs we would have to buy a new switch and a third NIC for our router/firewall.
Luckily the switch used supports 802.1q. The switch configuration is done by adding a new VLAN. How this is done should be documented in the switch documentation.
Networks
- WAN 172.16.0.0/24
- LAN 192.168.0.0/24
- DMZ 10.0.0.0/24
In the following steps we provide commands which you will have to enter in a terminal.
Installation
sudo apt-get install vlan
Configuration
1. Load the 8021q module into the kernel.
sudo modprobe 8021q
2. Create a new interface that is a member of a specific VLAN, VLAN id 10 is used in this example. Keep in mind you can only use physical interfaces as a base, creating VLAN's on virtual interfaces (i.e. eth0:1) will not work. We use the physical interface eth1 in this example. This command will add an additional interface next to the interfaces which have been configured already, so your existing configuration of eth1 will not be affected.
sudo vconfig add eth1 10
vconfig is deprecated and might be removed in the future, please migrate to ip(route2) as soon as possible! The ip(route2) replacement command is:
sudo ip link add link eth1 name eth1.10 type vlan id 10
3. Assign an address to the new interface.
sudo ip addr add 10.0.0.1/24 dev eth1.10
4. Starting the new interface.
sudo ip link set up eth1.10
Making it permanent
To make this setup permanent, the following lines have to be added a couple of configuration files.
1. Add the module to the kernel on boot:
sudo su -c 'echo "8021q" >> /etc/modules'
2. Create the interface and make it available when the system boots. Add the following lines to /etc/network/interfaces (change the values according to your scenario):
auto eth1.10
iface eth1.10 inet static
address 10.0.0.1
netmask 255.255.255.0
vlan-raw-device eth1