I have had a home lab for a number of years and enjoy working on it without being an absolute expert. 

 

I'm just curious how you deal with networks and running various applications that each belong in different network segments. 

My server runs in VLAN20, Management VLAN. 

But the applications that I often run belong in VLAN40, IoT or VLAN50, MEDIA. 

Example of MEDIA, Docker containers: PLEX, SABnzbd, Radarr, Sonarr, Bazarr, Tautulli, etc. etc. etc. When I put these on the standard Docker bridge, they are in the Management network where they do not belong. but in my opinion, attaching a macvlan to each container makes the network unnecessarily confusing, and macvlan provides standard container isolation, meaning that containers must be connected to both a macvlan and a separate bridge for internal communication. 

How do you do this? Everything in MacVLAN, accept that some containers are in a network where they don't belong? Or am I completely overlooking something?

You need to add vlans to unraids network settings... 

For each interface with vlan you would need a docker network created. When in the template to assign a IP, you would use the vlan network you created.

Also potential Hardware for L2/L3 that can use and support/need trunk / spanning tree to assist with physical connections... Each Vlan will need its own interface
As by default br0 is using vlan1 until you turn on vlans, everything traverses vlan1...

When you have vlans, you need a IP route and a interface... Usually in Linux a vlan is noted via <interface.##>

so vlan 20 would be as example br0.20

 

With unirad you needs a few things pre done...

While you can use IPVLan, it is recommended to use macvlan....

So lets review a few things...

 

Unraid recommended Docker settings:

*You need Preserve User Defined networks...
 

To effectively manage VLANs with Unraid and Docker, you can follow these structured steps. Here’s a more refined approach to address your specific setup and optimize your network organization:

 

Understanding the VLANs and Their Use Cases

1. Management VLAN (VLAN20): Reserved for server management, including Unraid's web UI and administrative access.

2. IoT VLAN (VLAN40): For smart devices or isolated IoT applications.

3. Media VLAN (VLAN50): For media-related applications like Plex, Sonarr, and Radarr.

 

Why macvlan Is Recommended

1. MAC Address Segregation: Each container gets a unique MAC address, which helps maintain proper VLAN separation.

2. Improved Network Segmentation: macvlan allows containers to be part of specific VLANs, aligning with your desired network structure.

3. Isolation: macvlan provides isolation at Layer 2, ensuring that broadcast/multicast traffic is limited to the intended VLAN.

 

Enable VLANs on Unraid

Go to Settings > Network Settings in the Unraid web UI.

Enable VLANs on the appropriate physical network interface (e.g., br0).

 

Define VLANs:

-VLAN20: br0.20

-VLAN40: br0.40

-VLAN50: br0.50
 

It is recommend to Assign IP addresses for these VLANs if needed (ensure they don't conflict with your DHCP server). sty on that dhcp server or subnet.
*As some also make each vlan with there own subnet Ip
ex
192.168.20.0/24 for vlan 20 so any conection on vlan 20 should also havea ip of 192.168.20.x
192.168.40.0/24 for vlan 40 etc etc...

If not direct connected to the router with vlan support. you may need to setup switch hardware:
 

Configure the Network Switch

Ensure the port connected to your Unraid server is configured as a trunk port.

Allow the VLANs (20, 40, 50) on this trunk port.

Configure spanning-tree appropriately to avoid broadcast storms.

 

Final make a docker network for each vlan

Example:

# VLAN20 (Management)
docker network create \
  --driver=macvlan \
  --subnet=192.168.20.0/24 \
  --gateway=192.168.20.1 \
  --ip-range=192.168.20.128/25 \
  -o parent=br0.20 vlan20_net

# VLAN40 (IoT)
docker network create \
  --driver=macvlan \
  --subnet=192.168.40.0/24 \
  --gateway=192.168.40.1 \
  --ip-range=192.168.40.128/25 \
  -o parent=br0.40 vlan40_net

# VLAN50 (Media)
docker network create \
  --driver=macvlan \
  --subnet=192.168.50.0/24 \
  --gateway=192.168.50.1 \
  --ip-range=192.168.50.128/25 \
  -o parent=br0.50 vlan50_net

While macvlan is the preferred choice for most, IPVlan can simplify the setup:

IPVlan eliminates the need for separate MAC addresses for each container.

This reduces complexity but may have limited compatibility with some setups.(some dockers like pihole require there own mac for other network related stuf...

To use IPVlan, replace the --driver=macvlan option with --driver=ipvlan in the Docker network creation commands.

 

 

Then in unraid docker template, when edit the docker under docker netwrok options you will now see a custom network that say vlan20_net or 40_net etc etc...
select that netwrok for the docker you want over that vlan for isolation...

 

Unraid is not a network device... it is best to use physcial Hardware...

Internal Container Communication:

If containers need to communicate internally across VLANs, consider setting up an additional bridge network for cross-VLAN communication while keeping external access through macvlan.

Routing Between VLANs:

Use your router or firewall to manage inter-VLAN traffic. Ensure proper rules to allow or deny traffic based on your security needs.