Under Debian I need to bridge a vlan eth0.1 and tap tap0. Usually, when bridging a normal ethernet adapter with a tap I would include something along the lines of this in /etc/network/interfaces:

auto br0
iface br0 inet static
      pre-up /usr/sbin/openvpn --mktun --dev tap0
      pre-up /usr/sbin/brctl addbr br0
      post-up /sbin/ip link set tap0 up
      post-up /usr/sbin/brctl addif br0 tap0
      post-up /sbin/ip link set eth0 up
      post-up /usr/sbin/brctl addif br0 eth0
      post-down /sbin/ip link set br0 down
      post-down /usr/sbin/brctl delbr br0
      post-down /usr/sbin/openvpn --rmtun tap0
      post-down /sbin/ip link set eth0 down

Now, I will admit it is not pretty (we manually create the tun and the bridge using the raw commands) although it is the most Debian-like means I've found. The problem comes when I want to replace eth0 with a vlan, such as eth0.1. The only way I can think of is manually adding pre-up and post-down commands to manually create the eth0.1 vlan (with all others being configured the Debian way).

However, I am not totally sure then as the post-down /sbin/ip link set eth0 down may break other eth0.x vlans. Can someone suggest a cleaner means of accomplishing my goals?


"the most Debian-like means I've found" -- you need to look harder, possibly in the bridge-utils-interfaces(5) man page.

Bridging VLAN interfaces is trivial; you just put the VLAN interface in as a manual one (ie iface eth0.1 inet manual) and then add eth0.1 into the bridge_ports list.

A quick note on OpenVPN and it's Ethernet mode -- don't.


You can bring up your tuntap device together with the vlan interface and bridge afterwards:

  # The physical network port
  allow-hotplug eth0
  auto eth0
  iface eth0 inet manual

  # The interface used for the bridge
  auto vlan1
  iface vlan1 inet manual
        vlan_raw_device eth0
        pre-up ip tuntap add dev tap0 mode tap user openvpn-system-user
        pre-up ip link set tap0 up
        post-down ip link set tap0 down
        post-down ip tuntap del dev tap0 mode tap

  # The bridge interface
  auto br0
  iface br0 inet static
        pre-up ip link set vlan1 up
        pre-up ip link set tap0 up
        bridge_ports vlan1 tap0
        bridge_waitport 5
        bridge_waitmax 10
        bridge_fd 0
        bridge_stp off
        dns-search-domain openvpn.example.net
        post-down ip link set tap0 down
        post-down ip link set vlan1 down

You need to adjust the user you want the tap interface to be owned and of course all ip settings and timings.

You need to have the vlan and bridge-utils package installed for your setup to work.

This setup up is even possible on a bonded ethernet interface: I described it in the Debian network configuration for a briged tap on a bonded interface with VLAN Pseudo-HOW-TO.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.