FreeBSD - Using and Configuring a VLAN

[00:00:14]Hello everyone and welcome to my channel. In this video, as per user request, I'm going to show you how to use and to how how to configure VLANs in FreeBSD. Okay? Let's do this.

[00:00:28]I'm going to start by showing you a diagram that I've drawn. So, here you can see I will [clears throat] be showing three virtual machines, VM 1, 2, and 3.

[00:00:41]Uh the first virtual machine is connected to the internet through the VTNET0 interface.

[00:00:49]Then I'm going to show you that there is a private network that connects to VTNET1 in the first machine and VTNET0 in the second and third, respectively.

[00:01:03]The I'm going to build a VLAN that I'm going to call number 10 between 1 and 2, and VLAN 20 between 1 and 3.

[00:01:14]So, why are these VLANs What is the purpose of the VLAN?

[00:01:19]Basically, it's a logical separation of the traffic, meaning it's like you have those pipes that you see here between the machines, and the traffic that goes in one VLAN cannot be seen by the other VLAN.

[00:01:34]So, this means virtual machine number two should be able to talk with virtual machine number one, but virtual machine number two cannot talk with virtual machine number three because they are in different VLANs. So, this is the principle.

[00:01:50]>> [snorts] >> Um I'm also going to show you that you can you can just very simply configure PF to do internet the network address translation and I get internet in VM2.

[00:02:08]All right, so let's get this party started.

[00:02:12]So all right, here we are.

[00:02:14]You can see I have here three virtual machines VM1, VM2, VM3 and let's look at the configuration for VM1. This one has two network interfaces. So one which is the shared network which is going to allow the machine to connect to the internet.

[00:02:33]The second network interface is the private network interface.

[00:02:38]So virtual machine number two has only the private network and the same should be for virtual machine number three.

[00:02:46]Okay, I closed the window. That should not have happened.

[00:02:51]And yes, >> [clears throat] >> virtual machine number three. So as only has the private network.

[00:03:00]So let's start for now virtual machine number one.

[00:03:07]And let's see the configuration.

[00:03:15]So we're going to do this step-by-step.

[00:03:20]And the first thing as a first step we're going to configure things by hand and then we're going to configure this to make it persistent in /etc/rc.conf.

[00:03:33]So [snorts] now [clears throat] it's just the first machine. So now let's just try the if to see if config and you see here VTnet0 has an IP address it's 64.22 and VTnet1 currently has configured an IPv4 and I think it should also get an IPv6.

[00:03:57]Maybe it takes a little bit of time, but um >> [clears throat] >> I think it's going to get an IPv6 address also.

[00:04:05]No problem. So, uh one thing because let me actually show you back the the diagram here.

[00:04:13]Um we don't want those interfaces here to get by themselves an IP address because otherwise the machines would be able to talk between themselves. I mean, they would be they would avoid the VLAN communication.

[00:04:28]And I want to show you that VM3 cannot talk with VM2.

[00:04:33]And therefore, I'm not going to give an IP address to VTNet1 um here.

[00:04:40]But I'm going to give an IP address to the VLAN10 and to the VLAN20.

[00:04:46]All right. So, coming back here to the machine, let's see. Yes.

[00:04:51]>> [clears throat] >> So, we have VTNet1.

[00:04:53]Um uh let's start by taking out the IP address. So, ifconfig VTNet1 delete.

[00:05:02]And we should be uh good.

[00:05:06]VTNet um one now has uh no IPv4 address.

[00:05:13]All right.

[00:05:14]So, and now let's start to create the VLAN10. So, ifconfig um let's say VLAN10 >> [snorts] >> uh create.

[00:05:25]Okay. So, if we look at the ifconfig, we now have a VLAN number 10.

[00:05:31]And now let's configure this. So, ifconfig VLAN10, uh let me look at my notes. So, >> [clears throat] >> uh it's going to be on VLAN uh 10 on VLAN dev uh VTNet1 because this is where it's connected.

[00:05:49]And again, ifconfig [clears throat] you see here the parent if interface is VTnet one. All right. So, ifconfig on VLAN 10, oh, let's give it an IPv4 address.

[00:06:03]It's going to be 192.168.10.1.

[00:06:07]Netmask 255 255.255.0 and let's just bring the interface up.

[00:06:18]And now we can see here VLAN 10 has an inet 192.168.10.1.

[00:06:24]Okay. VTnet one didn't get an IPv6 address. That's That's okay.

[00:06:31]Now, let's start the other machine.

[00:06:34]This VM number two.

[00:06:38]And yeah, let's do the same thing, basically.

[00:06:46]And we're going to check that they have they can communicate with uh uh between each other.

[00:06:55]So, the machine is now starting and it's by default when you install FreeBSD, it's it's requesting a DHCP.

[00:07:02]I'm just going to press control C.

[00:07:06]Um I don't need that.

[00:07:08]So, ifconfig we [clears throat] see VTnet zero.

[00:07:12]It's on the 128.7. This is the private IP address. We don't need So, ifconfig VTnet zero, delete.

[00:07:23]And um ifconfig um this one does have some IPv6 addresses and we're going to delete this.

[00:07:32]So, um let's do uh ifconfig VTnet zero and let's extract with awk. Let's extract the uh inet 6.

[00:07:49]And here, let's just uh print the second column.

[00:07:55]And you see these are the the two IPv6 addresses that the machine has. And now we just need to delete each one of them.

[00:08:03]And we do this by passing it into xargs.

[00:08:07]-j percentage means use the percentage sign as a placeholder.

[00:08:12]Uh L1 means run a command for every input, for each one that we have, so each line.

[00:08:20]And it's the ifconfig that we want.

[00:08:24]>> [snorts] >> vtnet0 inet6 Now, the this one here and delete. And this should get rid of both those addresses.

[00:08:36]So, let's uh look at ifconfig and vtnet0 has no IPv6 addresses. Nice. Okay.

[00:08:46]Now, let's do the same thing. ifconfig vlan10 create Okay. ifconfig and we have vlan10. So, vtnet has zero has no IP address, so it's the Although the VM1 and V the first virtual machine and the second one are in the same private um connected to the same private network.

[00:09:12]They cannot talk to each other because they don't have the in [clears throat] the vtnet there's no IP address. But now, let's create a VLAN, so vlan10.

[00:09:22]Uh the same thing we did for the other machine is uh let's uh do the vlan10. Let's uh say that this is in the vlan10.

[00:09:32]And VLAN device, in this case vtnet0.

[00:09:37]And ifconfig vlan 10 as we're going to put this uh hardcoded to 10.2 netmask 255.255.255.0 let's bring this interface up.

[00:09:53]So now we see here it's uh the parent interface is VTN zero. So this is the VLAN 10 with the the proto the proto one uh 802.1Q etc. Let's let's just try to ping 192.168.10.1.

[00:10:14][snorts] Yes, we can ping that um the other machine.

[00:10:20]>> [clears throat] >> And we are all good to go.

[00:10:23]Now let's create the third machine.

[00:10:27]So let's move the windows here a little bit and let's Oh, it's uh still shows that it's starting. That's uh not entirely correct, but um okay.

[00:10:38]Uh let's um >> [clears throat and cough] >> Sorry.

[00:10:44]Um let's start this machine and now we're going to do the same thing. So here control C, I don't want that IPv4 address.

[00:10:54]Uh sorry, not ifconfig. We need to log in before. Um yes.

[00:11:00]ifconfig And [snorts] we have here the same thing. So but this is another machine.

[00:11:06]Uh we have VTN zero. This is the the third machine. Yeah, so ifconfig VTN zero, let's delete the IPv 4 address. Let's see, it still has the IPv6.

[00:11:23]So let's do the same.

[00:11:24]ifconfig VTN zero uh awk and uh inet six Let's print the second column. There we [clears throat] are.

[00:11:41]And not awk, ix arcs. Ifconfig uh VLAN zero inet six this one here and delete. And of course, I forgot in the ix arcs, I forgot the J percentage and the L1. This is important.

[00:12:02]Um Oh, it's not VLAN zero, it's vtnet.

[00:12:08]Yes, of course.

[00:12:09]So, >> [clears throat] >> now it got rid of both addresses and we can start building our VLAN. So, ifconfig VLAN In this case, we're going to put this in 20, create. So, uh so, that's the name we give.

[00:12:25]Ifconfig VLAN 20 we're going to see this is in the VLAN 20 and VLAN dev is going to be vtnet zero.

[00:12:35]And ifconfig VLAN 20 192.168.

[00:12:41]20.2 netmask 255.255.255.0 Let's bring this up.

[00:12:49]And here we are. Uh it's the 20.2 in VLAN 20. Can we ping the 10.1 or 10.

[00:12:58]uh two? Let's try. 192.168.

[00:13:02]Um 10.1 No route to host.

[00:13:06]10.2 Also not.

[00:13:09]You might have uh been noticed that I did not create or did not configure the VLAN still in the first machine. So, if we go here, 20.1, it doesn't work. Yeah, because we need to create this in the first machine. So, let's let's do that. Let's search for the first machine. Where is it?

[00:13:32]Should be here.

[00:13:36]Here is the Here is the first machine.

[00:13:38]And ifconfig uh we have VLAN 10. Let's do the same thing. So, ifconfig VLAN 20 create.

[00:13:48]ifconfig VLAN 20 Uh VLAN is going to be placed at 20 and VLAN dev it's going to be VTNET Z In this this machine is VTNET one because we have the 12 network interfaces, yeah?

[00:14:04]Uh ifconfig VLAN 20 Oops, not clan.

[00:14:09]VLAN 20 we give the static IP address on 20.1, netmask 255.255.255.0, and state up.

[00:14:21]Let's again see.

[00:14:23]This we have the 10.1 in VLAN 10 and 20.1 in VLAN 20. Now, ping 192 Oops, 192.168.20.1.

[00:14:35]This is our local address. And now 20.2, that's the third machine.

[00:14:41]Uh and if we try 10.2, it it's working.

[00:14:47]Now, let's try to pick up the virtual machine three again. Here it is and let's try again 20.1. Now, it works because the VLAN is created and um what about 10.1?

[00:15:02]This should still no not work and 10.2 should still not work.

[00:15:07]The same thing is going to be for the other machine.

[00:15:10]So, now just for curiosity, let's just do a TCP dump. ei The e stands for to dump the ethernet headers, which we need to see the VLAN.

[00:15:22]Uh e i n v t net one. Okay.

[00:15:27]And [snorts] now let's uh take this let's take this machine. Can I make maybe make it a little bit smaller? No, I cannot.

[00:15:36]Uh but maybe I can move things a little bit around.

[00:15:41]And you should be able to see actually in this direction.

[00:15:45]Uh here uh yeah.

[00:15:47]In this area here um you should be able to see the IP address uh the the things coming through. So, let's [clears throat] let's try to see. So, um um ping 192.168 Uh this we are in 10.1.

[00:16:09]And here we are let's So, let's just stop. We see already some things going.

[00:16:14]And you see here the magical the magical value. Where is it? Come on.

[00:16:20]Uh you saw there up uh my mouse unfortunately disappears. But you see VLAN 10. You see length 102 VLAN 10.

[00:16:29]Let's go for the other machine and try to do the same thing. Ping 10. uh 20.1 in this case. And let's um go to this machine and see here. Yes, it's on VLAN 20.

[00:16:46]Uh so, the traffic is really being um transported across the different um across the different um uh machines. So, um actually not across it's going it's being tunneled through the different VLAN.

[00:17:03]Before we make this persistent, um let's configure this uh between the the first and the second machine, let's configure this in such a way that it becomes kind of permanent.

[00:17:15]And for that, we're going just to edit etc. rc.conf.

[00:17:22]And here you can see vtnet1 is currently configured as DHCP. I'm going to comment this one out and I'm going to say ifconfig so cloned interfaces is going to be actually we're making it consistent persistent now. So VLAN 10 and VLAN 20 Let's Let's just do the both at the same time now.

[00:17:51]ifconfig and VLAN 10 is going to be VLAN so Let me look at my notes. inet 192 168 10.1 netmask 255.255.255.0 >> [snorts] >> and VLAN 10. This is VLAN 10 yes and VLAN 12 we're going to see make it vtnet1 and ifconfig on Actually let me just copy the things here. This is going to be 20. This is going to be a 20 here and this is going to be VLAN 20.

[00:18:43]So very similar and ifconfig vtnet0 one and let's bring the interface up without an IP address.

[00:18:56]All right. Let's Let's reboot this machine and let's see what happens.

[00:19:02]Hopefully the configurations we have done before are going to be kept meaning the machine boots and gets the VLANs working properly and the the VTNET one doesn't get an IP address.

[00:19:21]All right. So, let's log in. Ifconfig, what we see? We see VTNET one has no IP V4 or IPV6 address and VLAN 10 it's configured. I think looks good, right?

[00:19:36]So, ping 192.168.10.

[00:19:40]uh two. There we go. And 20.2.

[00:19:44]Hooray, it's working and it's persistent.

[00:19:48]Now, let's try to make uh to bring uh internet um so that this machine here can communicate to the internet. So, if we go and we try uh pkg install actually pkg update.

[00:20:06]It currently could not resolve host name and lots of things. So, it's it doesn't really work. Okay, so let's try and uh change this. For that, I might have uh had it here a pf. Oops, pf.conf. So, let's start etc pf.conf.

[00:20:32]And the minimal set is match on VTNET zero from 192.168.

[00:20:42]uh 10.0.

[00:20:45]So, in this um address segment uh /24 to any net to uh VTNET zero.

[00:20:56]I It should be enough and pass all.

[00:21:01]And uh service pf enable.

[00:21:06]So, we enable the PF.

[00:21:08]Um and we also need another thing. We're going to I'm going to sysrc net.inet.ip.forwarding net.inet.ip.forwarding enable equals yes.

[00:21:23]And let's just do this by hand before I So, before I I reboot the machine, it should be sysctl net.inet.ip.forwarding Oops, my fingers are The keyboard is a little bit difficult.

[00:21:38]inet.ip.forwarding forwarding Uh it's currently set to zero. Oops.

[00:21:47]Let's set this to one.

[00:21:49]And service PF start.

[00:21:53]Okay.

[00:21:54]Um net to Uh did I do something wrong?

[00:22:02]match out on Okay, I might have screwed that one up.

[00:22:09]Out match out and service PF start.

[00:22:14]Nice. Okay. So, this is matching out doing uh uh network address translation on the outgoing packets.

[00:22:23]Here, this is the the second machine and of course it still doesn't have the um the things configured.

[00:22:32]But, we need to do route out add default 10.192.168.10.1 10.1. So, that that is our default gateway. It's the first machine. And um I might have done this already.

[00:22:48]resolve.conf Yes, it's already set. So, I I put here the name servers as 1.1.1.1 >> [snorts] >> and name server 8.8.8.8.

[00:22:59]Let's try this again. pkg update.

[00:23:03]Hooray, it's working. How cool is that?

[00:23:07]And uh just to make sure that things are going fine, we go here to the this machine, pkg update.

[00:23:19]And it doesn't work. It's the same thing.

[00:23:23]Um just to finalize the video, I'm going again to this uh to the first virtual machine. Let's edit pf.conf and we can just add another one. So, if it is 20 uh on on 20.0 >> [snorts] >> /24 and we do the same thing for vtnet0.

[00:23:46]So, service p um service pf restart.

[00:23:53]Um cat etc. Let me just see the one thing. Yeah, because I did service pf enable, if you reboot the machine, this becomes permanent. So, I'm fine with that.

[00:24:04]The third machine, which is still not working and you know already what's going to happen. So, here uh it doesn't work and um route add default Okay, default um 192 168. In this case, it's 20.1.

[00:24:23]Okay. Cat uh etc. Um so, resolve.conf.

[00:24:28]So, this is not there. Let's uh edit this uh etc. resolve.conf.

[00:24:35]Uh oh, vim not found. Ay ay ay, that's not good.

[00:24:39]Um so, let's uh just put here I I I can put it the other way around.

[00:24:45]This is no big no big deal. 1111 and pkg update and lo and behold, it's again working. Can the two machines see each other. Ping 192.168.20.1.

[00:25:01]This we can because we are in machine number three and 10.1. Oh, now it can.

[00:25:09]>> [snorts] >> Uh this is This is an interesting thing and this might bring you to think, okay, the machines are now I can see them.

[00:25:22]>> [laughter] >> The the machines can talk with each other, but the interesting thing is that those machines did Let's Let's just Let's just um do here uh TCP. Oops, this is machine number one.

[00:25:41]TCP dump EI VT net the one, yes.

[00:25:51]And now let's get this thing here running and you can see probably you see here the You're seeing that it goes from VLAN 20 and goes to VLAN number 10.

[00:26:04]And uh um Uh we would need to adapt the IP the so the PF firewall in such a way that this doesn't happen, okay?

[00:26:18]I'm going to try to do this very fast.

[00:26:20]So I do have some additional notes here that I'm going to try to go very fast here in the video. I'm going to see probably me typing and let's just see if things get separated now.

[00:26:35]So since this part here involves a little bit more typing, I just copied the configuration to the machine and now let's just have a quick look at it. ETC so pf.conf.

[00:26:49]What we see here is that we have the external interface, the LAN 20 interface, LAN 10 interface, sorry. We have the networks, the respective LAN 10 net and 20 net.

[00:27:03]>> [clears throat] >> Then we have here some policies to drop the packets and to skip on localhost. So if I'm not mistaken, this is to normalize the inbound package, meaning that is going to refragment and to enforce some TCP flags, etc. This is needed to properly process the different segments.

[00:27:26]Then we're just going to do net on external interface.

[00:27:31]So here from the different network segments and going to block the respective other package, but we're going to here, yes, we are specifically these are the important rules. We're going to block traffic from 10 to 20 and from 20 to 10. So the machine should not be able to talk with each other and we're going to allow the 10 to pass to any network and yeah, 10 to pass everything on external interface. So that this is a relatively small rule set.

[00:28:08]Service PF restart. So we restart the service and now let's go to machine number Just looking here very quickly.

[00:28:21]This is a machine number two. So ifconfig we are here at 10.2. So let's try to ping 192.168.10.1.

[00:28:33]Yes, we can ping. Can we ping 20.1?

[00:28:37]No, we cannot. It's denied by the firewall as intended.

[00:28:42]Can we pkg update?

[00:28:46]Yes, we can. So, >> [clears throat] >> uh again, going back to the picture, you see um here there was a small a small thing that we needed to add in the rules. So, because we are netting traffic and we are allowing traffic to go from here from this VLAN to go to the internet, uh we need specifically to also to tell the PF firewall not to allow the traffic to re-enter. So, coming from VLAN 10 and entering VLAN 20 and vice versa.

[00:29:19]Okay, and uh that's it. Um per user request, we I did a small tutorial on how to use VLANs in FreeBSD. I hope you enjoyed it. And if you have some more additional comments or requests, you know what to do. Use the space down below. Otherwise, thanks for passing by and uh take care and see you next time.

[00:29:41]Bye-bye.