Re: bridge vlan_filtering don't work with tap devices (qemu guests)

Vlad Yasevich
2014-01-03T15:33:46Z

On 12/28/2013 08:00 AM, Toshiaki Makita wrote:
> On Fri, 2013-12-27 at 17:17 +0100, Alexandre DERUMIER wrote:
>> Little update:
>>
>> I can see now tagged packet on br0 with tcpdump, if I have
>>
>> #bridge vlan add dev br0 vid 10 self.
>>
>> All is working fine now.
>>
>> I have a last question :
>>
>> Is it possible to allow all vlans to go through a port. (or disable filtering for 1 specific port) ?
>
> AFAIK, it is impossible.
>
>>
>> If not, maybe could be it great to be able to add multiple vlans with bridge command,like
>> "bridge vlan add dev xxx vid 1-4096"
>> or
>> "bridge vlan add dev xxx vid 1,2,3-10,12,13-4096"
>
> Such commands seem to be not supported yet.

Patches welcome.

-vlad

>
>>
> [...]
>>>> Or didn't you set br0 in the same way as other ports like below?
>>>> # bridge vlan add dev br0 vid 10 pvid untagged self
>>
>> Indeed I didn't set vlan on br0. Isn't it only to tag packets coming from the bridge itself? (like a bridge management ip for example).
>> Or do we need to define all vlans allowed to pass through the bridge ?
>
> If br0 is promiscuous mode, you should be able to see all frames going
> through the bridge.
> But if vid 10 untagged is set on br0, incoming frames with vid 10 will
> be seen after untagged.
>
> If br0 is not promisc mode, you can see only packets delivered to or
> transmitted from br0.
>
> tcpdump normally puts a device into promisc mode, without -p option.
>
> You don't need to add all vids to pass through the bridge.
> Settings on br0 will affect only frames coming from or going to br0.
>
> Thanks,
> Toshiaki Makita
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>