Hey there, I've recently decided to add some vlans to my network, to add some layer of security and separate guest wifi, server etc.
Nearly everything works as indented but I've seen strange behaviour in terms of the br0 // br0.xx separation and I cant figure it out.
First of all my Setup:
vlan1 default network = 192.168.0.0/24 // 192.168.0.3 UNRAID // 192.168.0.1 Untangle FW
vlan20 guest wifi = 10.20.0.0/24 // no UNRAID IP on br0.20 // 0.1 Untangle FW
vlan30 IOT vlan/wifi = 10.30.0.0/24 // NO UNRAID IP on br0.30 // 0.1 Untangle FW
(I have however already set the network information for the vlan20 and vlan30 in the Settings -> Docker area)
[UNRAID -> 2x passthrough 1g nic to my Untangle firewall VM -> 1nic coming from the fibre modem of my ISP, 1nic to port1 GS110EMX (LAN NIC of the firewall)]
UNRAID -> br0 192.168.0.3/24 -> port10 GS110EMX
UNRAID -> br0.20 (no IP set) -> port10 GS110EMX
UNRAID -> br0.30 (no IP set) -> port10 GS110EMX
etc. etc.
For UNRAID the GS110EMX port10 has vlan1(default) set as untagged and VLAN20, 30 etc. as tagged.
For the firewall the GS110EMX port1 has vlan1 untagged and all other vlans as tagged.(traffic flows, dhcp works, everything fine)
I have a Unifi Controller container running for my wifi management(management vlan1) and some aps with wifi networks in the default vlan1, vlan20 and vlan30.
The Unifi controller runs on br0 with "bridge" as the network type.
When I connect a device to my wifi vlan20 and run an ip scanner like Advanced IP Scanner, it will see my UNRAID br0 interface(192.168.0.3) with ip, motherboard vendor and mac address(its the mac of eth0/br0).
When I remove vlan20 from port 10 of my GS110EMX the network scanner will no longer find my UNRAID br0 with 192.168.0.3. So I would assume the information is coming from br0.20 and not through my firewall or smth.
I thought, when there is no IP set on a vlan interface in UNRAID, then UNRAID will not answer on that nic or show any services, let alone it will answer with another int?
I would like to keep br0.20 in that vlan but stop my main br0 from "presenting itself" to network scanners talking on vlan20. Is it some weird behaviour because its a network bridge? Am I doing smth wrong?
I also tried to use another nic on my server to physically separate br0 and the vlans. So I went for br0(192.168.0.3) on eth0, br1(no ip) on eth1 and added the vlans to br1 = br1.20, br1.30 etc.
It sadly did not change the behaviour, my notebook in wifi vlan20 could still "see" the br0 int with 192.168.0.3 ... only when I removed vlan20 from the switch port of br1 the scan stopped showing the br0 details.
I needs to be said, that no access is possible to that br0 int in any way, cant ping, cant see open ports, cant access the webui, cant ssh ... everything is blocked but you can see the ip, mobo-vendor and mac.
Maybe thats helpful??? I started a tcpdump on br0.20 while running the scan and can see the following:
root@Vault:~# tcpdump -i br0.20 src 10.20.0.149
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0.20, link-type EN10MB (Ethernet), capture size 262144 bytes
16:56:01.043646 ARP, Request who-has Vault.local tell Iris-PC, length 46
16:56:11.919226 IP Iris-PC.49667 > 239.255.255.250.3702: UDP, length 656
Im new to the vlan topic, doing a newbie error or maybe this is an indented behaviour?
Would love to hear the opinion of someone else. If nothing comes up I guess I will just remove the vlan int from unraid and run everything via routing from the firewall into br0 ...
Thank you in advance!
vault-diagnostics-20220104-1804.zip