Hey guys, I'm trying to get VLAN's configured on my virtual machines in UNRAID.  Currently I have a default VLAN1 which is my general network, then I have VLAN10(Security) and VLAN20(IOT).  What I've done is added all my security cameras to VLAN10, and firewalled them from the internet and the other VLAN using the Unifi USG.  I've firewalled and blocked all traffic to VLAN20 except from it to the internet.

 

I've been doing some testing with my laptop on the VLAN10(security) network, and it appears all my firewalls are working.  I've done the same with IOT.  

 

What I now want to do is take one of my VM's which is running Windows 10, and use it to connect to my VLAN1 network and to connect to the VLAN10 network so that the software running on it can record the cameras.  

 

In UNRAID I have 2 physical network connections that are bridged and used as a backup scenario.  I've added VLAN10 to the UNRAID network settings.  In my Windows 10 VM I've added another network connection and used the Br0.10 setting that will allow my Windows VM to receive that VLAN traffic.

 

When I get into my Windows 10 VM I disabled the new connection, and ran some ping tests.  What I found is that I can still ping Devices on VLAN10(Security).  So I went into the driver settings on the connection and under VLAN's I chose to Disable Priority and VLAN Tagging.  This allowed me to not ping those devices.  I then followed through with enabling the new connection, and dove into the driver settings as well.  Under Priority and VLAN Tagging, I chose VLAN.  This then allowed me to ping VLAN10(Security) with this separate connection.

 

To give you an idea on how I have my switch configured: (Netgear GS724Tv4)

On VLAN1(Default) I have every port Untagged

On VLAN10 I have tagged the Unifi USG, All Camera ports, and the 2 physical connections for my UNRAID server

 

 

What I want to know:

Why does a single connection in Windows 10 allow for both VLAN and untagged traffic to connect?

Is there a configuration that I can set up so that only the specific connection I assign can have access to the VLANs?

If I add another VM without a VLAN assignment, will this allow that VM to also connect to VLAN10?

Does anyone have any background in this?  It's technically working, but I want to be able to control who has access to the VLAN if I create more virtual machines...

Your VLANs eventually end up on your router I presume. At this point you'll need to make firewall rules to allow or deny traffic between those separate networks.

I already had those preferences set up.  I can't ping VLAN10 from another computer on my Default VLAN1.  I checked the reverse by connecting my laptop on VLAN10 to ping VLAN1.  

 

Now in my Windows 10 VM, I have a regular "br0" configured, and "br0.10" configured.  

 

I loaded up the VM, and disabled the new connection which should be configured to "br0.10."  The other connection I varified that it was the proper IP/subnet for VLAN1 (Default).  

 

I then proceeded to ping the laptop and cameras on VLAN10, and I was able to ping them still.  This tells me that it doesn't matter whether you have a connection for VLAN or regular bridged traffic, you will still be able to access those networks even if they are firewalled from each other.  The reason is because both br0 and br0.10 are configured into the connections created by Windows 10.

 

The only way i was able to segregate them was to do some driver tuning and changing the Priority and VLAN tagging settings.

 

What I want to know is how do I assign the br0 and br0.10 to specific connections rather than them be shared on the two connections.  Essentially I want to do this if I were to install Windows 10 on another VM, and not allow anyone to change IP settings and gain access to that network.

 

It seems like it would be simple, but UNRAID doesn't seem to do what I interpret it is doing.  

It should be sufficient to assign a VLAN interface to a VM, like this

 

My VMs all use VLAN 4. The br0.4 interface is configured in a different network on my USG router.

 

This give the Windows VM an address in a different network as the unRAID server.

 

At this point any firewall rules on the router define what is allowed between these networks.

 

Hmm, that may be my issue.  I have my VM on the same network as UNRAID.  I'm curious to find out if I disable a connection and only use VLAN connections if that will make a difference.

7 minutes ago, strikermed said:

Hmm, that may be my issue.  I have my VM on the same network as UNRAID.  I'm curious to find out if I disable a connection and only use VLAN connections if that will make a difference.

 

When everthing is configured in the same network then VLAN segregation will not work. The idea of VLANs is to create logical separated networks and a let a router/firewall act as an mediator between those networks.

 

Also when you configre "tagged" ports on your switch it requires the clients connected to those ports to add a VLAN tag themselves to differentiate communication. Not sure if that is your intention.

 

Another approach is to make a port untagged and assign it to a particular VLAN, not sure how that is called on a netgear switch, but usual names are "native VLAN" or "PVID". This lets the switch make logical segrgations without the need to do VLAN tagging on the clients themselves.

 

On 12/12/2017 at 3:39 PM, bonienl said:

 

When everthing is configured in the same network then VLAN segregation will not work. The idea of VLANs is to create logical separated networks and a let a router/firewall act as an mediator between those networks.

 

Also when you configre "tagged" ports on your switch it requires the clients connected to those ports to add a VLAN tag themselves to differentiate communication. Not sure if that is your intention.

 

Another approach is to make a port untagged and assign it to a particular VLAN, not sure how that is called on a netgear switch, but usual names are "native VLAN" or "PVID". This lets the switch make logical segrgations without the need to do VLAN tagging on the clients themselves.

 

Thanks for the info.  From what your telling me I had it configured correctly.

 

In UNRAID you add a vlan to the bridge, thus it is VLAN aware, so I need to trunk the port to the UNRAID server.  From there I set up a connection in the VM for both normal traffic and VLAN traffic.  In the driver I needed to make a modification changing the VLAN priority from all to either Disabled for the normal traffic connection, and VLAN for the VLAN traffic.

 

This has worked, and I was able to set up the firewall to restrict packets in the way I want.

 

Now if I can only sort out this VM to VM connection issue.  Apparently transferring a single file over my normal connection to a FreeNAS VM is causing the Windows VM to lock up and it only transfers at about a gigabit speed even though I know the IP will connect them directly (proven before).  I've reached over 600MB/s in the same configuration, but I think messing around with Shares on FreeNAS has messed something up.  I didn't remove any shares, I just changed file permissions, but something went wrong....

With separate networks all traffic has to pass your router. Performance of your router comes into play here.

 

Edited December 14, 20178 yr by bonienl

7 hours ago, bonienl said:

With separate networks all traffic has to pass your router. Performance of your router comes into play here.

 

 

So I just took this into consideration.  I removed the VLAN connection on my windows 10 VM, and I also removed any VLAN configuration from UNRAID network settings.

 

I restarted the array and restarted all my VM.  Then I ran my test.  Again I saw no performance increase.  I'm only hitting 130MB/s real world transfer with a 4.5GB video file.  Same file I tested on my 10GbE connection I mentioned before.

 

I fallowed this up with some Driver tweaking.  I changed MTU from 1500 to 9000, and I changed transmit buffer from 256 to 1024.  This caused my VM to lock up again, and disconnect.  I've come to the conclusion that the RedHat drivers aren't like the intel drivers in terms of tweaking, but I also don't know what could possibly be different from the last time I got 500-600 MB/s transfer speeds....

2 minutes ago, strikermed said:

I fallowed this up with some Driver tweaking.

 

Have you tried the latest virtIO drivers, version 0.1.141 ?

 

4 minutes ago, bonienl said:

 

Have you tried the latest virtIO drivers, version 0.1.141 ?

 

I have not yet.  I think I still have the drivers from when I first installed early this year.

 

Mind point me in the right direction?

 

See https://fedoraproject.org/wiki/Windows_Virtio_Drivers

 

This is the direct link to download: https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso

 

Thanks!  I'll give these drivers a go.  

I just applied all the latest drivers to my WIndows 10 VM, and restarted.  The results are the same.  I'm still only getting 130-140MB/s.  No where near the 10Gigabit connection it has negotiated.  And keep in mind this is VM to VM

If it is VM to VM then only your disk speed is relevant. 130-140MB/s sounds like a HDD performance cap.

My UNRAID array is made up of only SSD.  1 SSD for parity, and the other 2 are for virtual machines.  They clock at 500-550MB/s

 

My Windows VM is installed on these SSD, and my FreeNAS is also installed on the SSD array.

 

Now the actual data I'm transferring is coming off a RAIDZ2 array on the FreeNAS and it's comprised of 5 hard drives.  Like I mentioned before.  I have another WIndows 10 Client with a 10GbE card direct connected to FreeNAS with a 10GbE card.  The same exact file transfer runs at 500-650MB/s.  So I'm seeing some kind of issue with the Virtual Bridge through UNRAID which is not doing meeting the network connections potential with the caveat of the SSD bottleneck. 

 

Now I have seen this same exact setup reach those potential speeds, but that was before I did some VLAN configurations.  I have since removed all VLAN configurations, changed switch back so it's not Tagging packets for the VLAN, and still no luck....

 

I still have no idea what is going on.