Adding an interface#

Add interface on Interfaces opens a side panel that makes one of six kinds of interface. Add interface in its footer adds it to the pending changes; the Commit Bar applies it. Everything about it can be changed afterwards from the interface panel. In Advanced mode the panel shows the commands it will stage.

Ethernet ports are not made here: they exist because the box has them. PPPoE sessions are made on Uplinks and WireGuard interfaces on the WireGuard page.

A VLAN meant for devices — with its own DHCP, DNS and access policy — is best made on Networks, which does all of that at once. Here you make the VLAN alone.

The six types#

Type	What it asks for
VLAN	the parent interface and the VLAN ID
Bridge	a name, its ports, spanning tree
Bond	a name, its mode, its ports
Tunnel	a name, the encapsulation, the local and remote addresses
VXLAN	a name, the VNI, the remote address or multicast group
Dummy	a name

A name is filled in with the next free one of its kind — br0, bond0, tun0, vxlan0, dum0 — and a name already in use is refused under the field. Every type takes an Address and a Description as well; both may be empty.

VLAN#

Parent interface offers the Ethernet ports, bonds and bridges that can carry VLANs: a port that belongs to a bond or a bridge is not offered, because its tagged traffic arrives on the bond or bridge. VLAN ID is 1 to 4094, and not one already in use on the parent. The new interface is named after both: VLAN 20 on eth0 is eth0.20.

On a bridge, VLAN 1 is the bridge's own untagged traffic and is refused, and the VLAN brings three things with it: VLANs turned on for the bridge, the VLAN allowed on every port of the bridge, and — when the firewall drops traffic that has no connection state, as the installer's ruleset does — the router's own VLAN frames on bridges exempted from that. Without the exemption the router's replies never leave the bridge.

Bridge#

Member ports offers the ports that can join: no address of their own, in no other bridge or bond. Spanning tree turns the protocol on; do that when the bridge could form a loop with a switch. Give the bridge the address the segment uses, not its ports — see Bridge two ports.

Bond#

Mode is LACP (802.3ad) by default; the others are listed on the interface panel. Member ports offers Ethernet ports with no address, in no other bridge or bond. LACP needs the switch's ports in a port-channel first — see Bond two ports.

Tunnel#

Encapsulation is one of GRE, GRE carrying Ethernet frames, IP in IP, IPv6 in IPv4, or GRE over IPv6. Local address must be an address the router holds; Remote address is the far end's.

VXLAN#

VNI is 0 to 16777214. Remote address or group decides the kind of VXLAN: a multicast address, 224.0.0.0 to 239.255.255.255, is a group; anything else a single remote end. Local address may be empty.

Dummy#

A local interface that is always up and belongs to no wire: where a router ID, a routing protocol's source address or an anycast address lives. Give it a host address, a /32.

Worked example: a VLAN for a lab switch#

The goal is eth0.30 with the router at 192.0.2.1/24.

Network → Interfaces → Add interface.
Type VLAN, parent interface eth0, VLAN ID 30.
Address 192.0.2.1/24, description Lab.
Add interface, then Apply with auto-revert in the Commit Bar: the change adds an address.

eth0.30 is now a row on Interfaces, and on Networks with its policy Not set — open it there to give it a DHCP server, DNS and an access policy. The switch port carrying the trunk has to tag VLAN 30 too.