Re: bridge vlan_filtering don't work with tap devices (qemu guests)

[Toshiaki Makita <toshiaki.makita1@gmail.com>]

On Fri, 2013-12-27 at 17:17 +0100, Alexandre DERUMIER wrote:
> Little update: 
> 
> I can see now tagged packet on br0 with tcpdump, if I have
> 
> #bridge vlan add dev br0 vid 10 self.
> 
> All is working fine now.
> 
> I have a last question : 
> 
> Is it possible to allow all vlans to go through a port. (or disable filtering for 1 specific port) ?

AFAIK, it is impossible.

> 
> If not, maybe could be it great to be able to add multiple vlans with bridge command,like 
> "bridge vlan add dev xxx vid 1-4096"
> or
> "bridge vlan add dev xxx vid 1,2,3-10,12,13-4096"

Such commands seem to be not supported yet.

> 
[...]
> >>Or didn't you set br0 in the same way as other ports like below? 
> >># bridge vlan add dev br0 vid 10 pvid untagged self 
> 
> Indeed I didn't set vlan on br0. Isn't it only to tag packets coming from the bridge itself? (like a bridge management ip for example). 
> Or do we need to define all vlans allowed to pass through the bridge ? 

If br0 is promiscuous mode, you should be able to see all frames going
through the bridge.
But if vid 10 untagged is set on br0, incoming frames with vid 10 will
be seen after untagged.

If br0 is not promisc mode, you can see only packets delivered to or
transmitted from br0.

tcpdump normally puts a device into promisc mode, without -p option.

You don't need to add all vids to pass through the bridge.
Settings on br0 will affect only frames coming from or going to br0.

Thanks,
Toshiaki Makita