Add a VLAN#

You will end up with a tagged sub-interface on a physical port, carrying its own subnet. On VyOS a VLAN is a vif under the parent interface, which means its name is eth0.30 and its configuration lives under interfaces ethernet eth0 vif 30.

Before you start#

The operator role and a licence.
A VLAN identifier the switch on the other end also uses, on a port configured as a trunk.
The subnet you will give it.

Step 1 — Create it#

Network → Interfaces → + Add interface, type VLAN.

set interfaces ethernet eth0 vif 30
set interfaces ethernet eth0 vif 30 address 192.0.2.1/24
set interfaces ethernet eth0 vif 30 description 'guest'

The bare set on the vif node is what creates it; the address and description are optional in the panel and each adds one line.

Step 2 — Give the segment what it needs#

A VLAN with an address is a segment nothing can use yet. Three more things, each its own guide:

Addresses for its clients — Give a device the same address every time covers the reservation case; the shared network and pool live in the same subtree.

set service dhcp-server shared-network-name GUEST subnet 192.0.2.0/24 subnet-id 2
set service dhcp-server shared-network-name GUEST subnet 192.0.2.0/24 option default-router 192.0.2.1
set service dhcp-server shared-network-name GUEST subnet 192.0.2.0/24 option name-server 192.0.2.1
set service dhcp-server shared-network-name GUEST subnet 192.0.2.0/24 range 0 start 192.0.2.100
set service dhcp-server shared-network-name GUEST subnet 192.0.2.0/24 range 0 stop 192.0.2.200

A firewall rule that lets it out — the installer's forward chain admits the LAN interface by name, and eth0.30 is not eth0.

set firewall ipv4 forward filter rule 30 action accept
set firewall ipv4 forward filter rule 30 description 'guest out'
set firewall ipv4 forward filter rule 30 inbound-interface name eth0.30
set firewall ipv4 forward filter rule 30 outbound-interface name eth1

A default-drop ruleset that admits what you meant.

Source NAT, if it should reach the internet through the uplink's address. The installer's masquerade rule usually matches on the outbound interface rather than the source, in which case it already covers the new segment — check on the NAT page before adding a second.

Check it worked#

The interface exists and is up. The Interfaces page joins the configuration with kernel state: link, MTU, qdisc and counters, and flags anything the configuration does not declare.

bash

show interfaces ethernet eth0 vif 30
ip -d link show eth0.30

A client on the VLAN gets a lease and can reach the router.

bash

ping -c 3 192.0.2.1

And can reach out, if it is meant to. If it can ping the router but nothing beyond it, the forward rule is missing — check its hit counter on the Firewall page.

The switch agrees. Diagnostics → Neighbours shows what LLDP neighbours announce, including their VLAN configuration, which is the fastest way to find a trunk port that was never configured as one — See what the switch says it is.

Undoing it#

delete interfaces ethernet eth0 vif 30

Remove the DHCP scope and the firewall rule too, or the commit will fail on a scope whose subnet no longer has an interface.