I want to get my tags , ( 802.1q ) to the Guest I do not want KVM or CENT stripping the TAG and presenting untagged traffic. I will be having 600 Plus vlans on the switches port, and I need the Guests to handle the traffic. i can not create 600 bridges in /network-interfaces as the 600 vlans will grow to 2045 vlans.

Simular to ESX 4095 method where the esx passes all traffic to the guest. I am running Centos 7 KVM is installed and running well

If possible I may need to know the following.

Should i leave Network Manager installed on the Cent? Is there a Gui that can perform this for my networking, as many users will be managing these systems and we need something simple. can it be done through the network manager in gnome...

Thanks john inmontreal

  • You want to manage 2045 VLANs in Network manager? :D This doesn't sound very appealing. However I don't have a much better GUI at hand, Webmin etc. don't provide a much better overview. It "should" work in NM though. Regarding the guest: My advise would be to use a dedicated physical card instead of adding a bridge layer to such a big vlan trunk. It removes a lot of potential issues like high load, complicated configuration etc. and you can just pass on the VLANs without any interruption. May I ask for what you need such a big amount of VLANs? – Broco Sep 19 '16 at 18:45
  • You could use an untagged bridge and throw all traffic into the VM, where you still have to create 2045 tagged interfaces to intercept that traffic. Still sounds very unmanageable to me. – dyasny Sep 20 '16 at 13:22
  • actually i have over 4000 vlans, but limited presently by switch capabilities to max 2045 per switch. I would like to use 802.1ad ( QinQ) as I need over the 4094 limit... managing this many vlans is not hard once u understand the systems.. :) I am networking in a Research lab. and presently use ESX and have no issues and all works well with all the vlans, But we now will start to test KVM and the same situations with the same number of VLANS , but i want to let the guest deal with the vlan tagging..... – John Montreal Sep 20 '16 at 19:26

I don't use 802.3q (QnQ) on the host server to transmit vlans to guest virtual machines. Simply use bridge interface on real network interface or link aggregation group of them (bonding). Bridge inteface mustn't have any ip configuration. All vlans will be present on bridge inteface and available for guest machines. Don't forget to change switch port (ports) to vlan tagged mode (trunk mode) and allow needed vlans access on it (them).

You must create vlan interface on the host server to have access to it via network. By example br0.12, where 12 is your management vlan. Configure ip address and other network properties on this interface.

I usually disable NetworkManager service on host server, because it's comfortable for dynamic configuration of network Interfaces, not for static config.

Example: eth0 - management interface, eth1 - for all VM's, br0 - will be assigned to VM with all vlans, br31 - will be assigned to Windows VM's, witch can't use vlans, but needed to access to vlan 31 untagged. On the switch all vlans must be tagged.

/etc/sysconfig/network-scripts/ifcfg-eth0 file:


/etc/sysconfig/network-scripts/ifcfg-eth1 file:


/etc/sysconfig/network-scripts/ifcfg-br0 file:


/etc/sysconfig/network-scripts/ifcfg-br0.31 file:


/etc/sysconfig/network-scripts/ifcfg-br31 file:


To disable NetworkManager in Centos 6 and less:

chkconfig NetworkManager off
chkconfig network on
service NetworkManager stop
service network restart

To disable NetworkManager in Centos 7 and less:

systemctl disable NetworkManager
systemctl enable network
systemctl stop NetworkManager
systemctl resart network

Add to /etc/sysctl.conf next several lines and apply by command sysctl -p /etc/sysctl.conf

net.bridge.bridge-nf-call-ip6tables = 0 
net.bridge.bridge-nf-call-iptables = 0 
net.bridge.bridge-nf-call-arptables = 0

Check your firewall (iptables) that it allows forwarding.

  • can you be more specific.... maybe explaining a bit further on the setup or links to explanation on setting these up and i not using 802.1ad (QinQ) yet. I will be using one network card alone for management of the Linux, using untagged traffic, and a second card that is plugged into a tagged port with all the vlans yes a 802.1q port on the switch, but this network card is the one i want kvm to present to the guests, and the guests will use 802.1q ( Trunked) port as the guest operation system will understand 802.1q and use what ever vlan we define in its operation. – John Montreal Sep 20 '16 at 19:37
  • I have updated my answer. – Mikhail Khirgiy Sep 20 '16 at 21:08
  • works, now,,,,,,yes, interesting, I previously did all of this before ,i created the bridges and everything..... and it did not work before, the actual solution was the /etc/sysctl.conf file, i did not know this and missed doing that previously, , and once added all works, the routing now passes the packets. Your answer is PERFECT, this is how all answers should be, you are good... – John Montreal Sep 21 '16 at 17:12
  • The main think was enable forwarding net.ipv4.ip_forward=1 witch is disabled by default. – Mikhail Khirgiy Sep 21 '16 at 17:14
  • To get 2045 VLANs you'll need 2045 bridges and 2045 devices. The OP asked explicitly not to go this path. – EnzoR May 8 '18 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.