VLAN support on bridges from FreeBSD 15.x onwards, impact when?

[Rene78]

Happy New Year!

Searching the forum for VLANs on bridges results in a lot of information and configurations (e.g. link, link, link) where the bottomline seems to be "bridge over VLANs" and not use (not possible in OPNsense config) VLANs on bridges.

Now I have been reading up on the matter and see that"

• in FreeBSD 14.x man for IF_BRIDGE(4) there is no VLAN support (link)
• in FreeBSD 15.x man for IF_BRIDGE(4) there is VLAN support (see quote below, link)

Where I am aware that OPNsense is currently based on FreeBSD 14.3 I assume that OPNsense will move to 15.x at some point. this will offer VLAN support on bridges judging by the FreeBSD documentation.

Is this VLAN support on bridges also moving into OPNsense? Couldn't find it on the forum, but when is OPNsense moving to FreeBSD 15.x/16.x?
Arguably, having VLAN support on bridges could make multi-NIC box configurations (such as my trusty Qotom) a little easier with IPTV VLANs, WLAN VLANs, IOT VLANs etc. on top of a multi-NIC LAN_bridge with a single WAN interface. ;-) 

From the FreeBSD 15.x man IF_BRIDGE(4)

VLAN SUPPORT
       The if_bridge driver has   full support for virtual  LANs   (VLANs).   The
       bridge  implements  independent   VLAN  learning,   i.e. MAC addresses are
       learned on a per-VLAN basis, and   the same MAC address may be learned on
       multiple   interfaces on different   VLANs.   Incoming frames   with an   802.1Q
       tag will   be assigned to the appropriate VLAN.

       Traffic sent to or from the host   is not assigned   to a VLAN by  default.
       To  allow the host to communicate on a VLAN, configure a   vlan(4)   inter-
       face on the bridge and (if necessary) assign IP addresses there.

       By default no access control is enabled,   so any interface may  partici-
       pate in any VLAN.

       VLAN  filtering   may  be    enabled  on  a    bridge    using the ifconfig(8)
       vlanfilter option.  When   VLAN filtering is enabled,  an   interface  may
       only send and receive frames based on its configured VLAN access   list.

       The   interface's   untagged  VLAN  ID  may  be   configured  using  the
       ifconfig(8) untagged option.  If   an untagged VLAN ID is configured, in-
       coming frames will be assigned to that VLAN, and   the interface may  re-
       ceive outgoing untagged frames in that VLAN.

       The tagged VLAN access list may be configured using the tagged, +tagged
       and  -tagged options to ifconfig(8).  An   interface may send and receive
       tagged frames for any VLAN in its access   list.

       The bridge will automatically insert or remove 802.1q tags  as  needed,
       based  on  the  interface configuration,   when forwarding   frames between
       interfaces.  This tag processing   is only   done for interfaces with  VLAN
       filtering enabled.

[pfry]

Searching the forum for VLANs on bridges results in a lot of information and configurations[...]where the bottomline seems to be "bridge over VLANs" and not use (not possible in OPNsense config) VLANs on bridges.[...]

Are you suggesting that it's not possible to assign a VLAN interface to a bridge? It works fine. I use four bridges with nine VLAN interfaces (interfaces on a 10-port switch, broken out as a port expander) assigned among them.

[Patrick M. Hausen]

Currently you can bridge VLAN interfaces but not the other way round.

E.g. with FreeBSD 14:

igc0.1 - VLAN 1 on igc0
igc0.2 - VLAN 2 on igc0
igc1.1 - VLAN 1 on igc1
igc1.2 - VLAN 2 on igc1

bridge1 - members igc0.1, igc1.1
bridge2 - members igc0.2, igc2.2

This works well but is complicated and error prone to set up.

With FreeBSD 15:

bridge0 - members igc0, igc1

bridge0.1 - VLAN 1 on all bridge ports
bridge0.2 - VLAN 2 on all bridge ports


HTH,
Patrick

[Rene78]

Currently you can bridge VLAN interfaces but not the other way round.

E.g. with FreeBSD 14:

igc0.1 - VLAN 1 on igc0
igc0.2 - VLAN 2 on igc0
igc1.1 - VLAN 1 on igc1
igc1.2 - VLAN 2 on igc1

bridge1 - members igc0.1, igc1.1
bridge2 - members igc0.2, igc2.2

This works well but is complicated and error prone to set up.

With FreeBSD 15:

bridge0 - members igc0, igc1

bridge0.1 - VLAN 1 on all bridge ports
bridge0.2 - VLAN 2 on all bridge ports


HTH,
Patrick

Will this also be implemented in OPNsense? Not sure if all FreeBSD options are also implemented in OPNsense

[pfry]

Currently you can bridge VLAN interfaces but not the other way round.[...]

Ah, I missed the intent. The original VLAN assignment scheme was not a limitation/inconvenience for me. The value added by the new scheme seems limited, as it only provides a more traditional bridge-like configuration with no (apparent) added functionality. Not that I can say much about that, as I treat my firewall like a bridge and my bridges like port expanders, but I could use either method with little modification. (I actually prefer the old method, as some of my equipment is only manageable from VLAN 1, so isolating it would be potentially inconvenient.)

[Monviech (Cedrik)]

https://github.com/opnsense/core/issues/10576

https://github.com/opnsense/core/pull/10584

[Rene78]

https://github.com/opnsense/core/issues/10576

https://github.com/opnsense/core/pull/10584

Thanks for the update. Just to make sure, it is not in OPNSense 26.7.1, correct? While I do not require this feature at this time (currently bridging VLANs), I have upgraded to 26.7.1 and I checked the VLAN setup page in Interfaces/Devices/VLANs and was unable to add a VLAN to a bridge interface.

[Monviech (Cedrik)]

It was merged today, if you want to use it right away you can try it on 26.7.1 with the following command

Code Select Expand

opnsense-patch https://github.com/opnsense/core/commit/137513c
If you have any issues you can revert the patch with the same command.

I tested it on my hardware box and everything worked correctly for me. I also did a jail setup and verified the vlans working.

Tests welcome :)

PS:

My test setup looked like this:

Attention: I only used tagged vlans. igc0/igc2 and bridge0 receive only tagged frames from my switch, and don't have layer3 configured. I don't think I would recommend using the bridge0 itself for untagged frames as well. Aka don't use a native vlan if possible, also tag vlan 1 on the switch trunk.

Code Select Expand

igc0: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
options=4802028<VLAN_MTU,JUMBO_MTU,WOL_MAGIC,HWSTATS,MEXTPG>
ether f4:90:ea:00:d9:f1
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

igc2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=4802028<VLAN_MTU,JUMBO_MTU,WOL_MAGIC,HWSTATS,MEXTPG>
ether f4:90:ea:00:d9:f3
media: Ethernet autoselect
status: no carrier
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

bridge0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
description: bridge0 (opt3)
options=10<VLAN_HWTAGGING>
ether 58:9c:fc:10:3b:7c
id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
bridge flags=0<>
member: igc2 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
        port 3 priority 128 path cost 2000000 vlan protocol 802.1q
member: igc0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
        port 1 priority 128 path cost 55 vlan protocol 802.1q
groups: bridge
nd6 options=9<PERFORMNUD,IFDISABLED>

vlan0.3: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1496
description: bridge0_vlan3 (opt5)
options=0
ether 58:9c:fc:10:3b:7c
inet 172.16.2.30 netmask 0xffffff00 broadcast 172.16.2.255
groups: vlan
vlan: 3 vlanproto: 802.1q vlanpcp: 0 parent interface: bridge0
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

vlan0.4: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1496
description: bridge0_vlan4 (opt4)
options=0
ether 58:9c:fc:10:3b:7c
inet 172.16.3.30 netmask 0xffffff00 broadcast 172.16.3.255
groups: vlan
vlan: 4 vlanproto: 802.1q vlanpcp: 0 parent interface: bridge0
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>