How to bridge native and VLAN interface

chickenmc · 8 September 2026 05:23

For several years I used four of six NIC as native interfaces for RED, GREEN, BLUE and ORANGE in my private network. These are connected to some standard switches and everything was fine.

Because of my new job I want to use one additional NIC and create three VLAN and bridge them to the already existing zones.

When I look at my new manageable switch it seems that this NIC it not active.

Is it possible to use such a configuration?

ag · 8 September 2026 08:51

Hi @chickenmc. Welcome to the community.

From the picture, the Zone Configuration looks valid.

One VLAN per zone, one native assignment per NIC, and different VLAN tags on the same parent NIC should be a supported layout.

A few things to check, because the extra NIC can look dead on the switch even when IPFire has accepted the config:

Reboot after Save. The WUI only writes the config. The VLAN interfaces and bridges are created at boot.
On the switch, the port facing that NIC needs to be a tagged trunk for VLANs 2, 3 and 4. There is no Native assignment on eth5, so IPFire will not send any untagged zone traffic on that cable.
Watch for a loop. If those VLANs land back on the same LANs as the old native ports, IPFire now has two paths into each zone. You have STP on BLUE and ORANGE, but not on GREEN. If VLAN 2 joins the existing green LAN, that can cause a loop.

Thanks,
A G

chickenmc · 8 September 2026 14:48

Hi @ag ,

Thanks for your immediate answer.

I tried I tried already some different configurations and rebooted every time. But this did not really change anything.

To adopt the new manageable switch in my network, I connected it to one port of my standard switch. Then I assigned a fixed IP address from the green zone and configured the ports. Both uplink ports are tagged as trunk ports for VLAN 2, 3, 4. The other eight ports are access ports.

As long as I connect one uplink port to a port of my standard switch the configuration software shows the status “connected”. When i connect the uplink port to the VLAN NIC of IPFire the status of the switch changes to “disconnected”. All other ports are not yet used. Therefore, a loop should not be an issue.

I am not sure if it is useful. I used the terminal to check the status of the interfaces.

The first output shows the status when the VLAN NIC is not connected:

[root@ipfire ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: green0p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master green0 state UP group default qlen 1000
    link/ether a8:b8:e0:03:47:ad brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether a8:b8:e0:03:47:ae brd ff:ff:ff:ff:ff:ff
4: orange0p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master orange0 state UP group default qlen 1000
    link/ether a8:b8:e0:03:47:af brd ff:ff:ff:ff:ff:ff
5: blue0p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master blue0 state UP group default qlen 1000
    link/ether a8:b8:e0:03:47:b0 brd ff:ff:ff:ff:ff:ff
6: red0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc htb state UP group default qlen 1000
    link/ether a8:b8:e0:03:47:b1 brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.134/16 scope global red0
       valid_lft forever preferred_lft forever
7: eth5: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether a8:b8:e0:03:47:b2 brd ff:ff:ff:ff:ff:ff
8: green0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 02:47:22:b3:c4:c3 brd ff:ff:ff:ff:ff:ff
    inet 172.20.99.1/16 scope global green0
       valid_lft forever preferred_lft forever
9: green0p1@eth5: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel master green0 state LOWERLAYERDOWN group default qlen 1000
    link/ether 02:9f:2e:ac:ac:40 brd ff:ff:ff:ff:ff:ff
10: blue0p1@eth5: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel master blue0 state LOWERLAYERDOWN group default qlen 1000
    link/ether 02:68:7b:61:9f:96 brd ff:ff:ff:ff:ff:ff
11: orange0p1@eth5: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel master orange0 state LOWERLAYERDOWN group default qlen 1000
    link/ether 02:aa:a8:f0:88:1e brd ff:ff:ff:ff:ff:ff
12: blue0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 02:76:6a:d1:9e:ee brd ff:ff:ff:ff:ff:ff
    inet 172.21.0.1/16 scope global blue0
       valid_lft forever preferred_lft forever
13: orange0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 02:ac:0b:98:c7:a0 brd ff:ff:ff:ff:ff:ff
    inet 172.19.0.1/16 scope global orange0
       valid_lft forever preferred_lft forever
14: ifb0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 32
    link/ether b6:45:ba:03:42:24 brd ff:ff:ff:ff:ff:ff
15: ifb1: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 32
    link/ether 52:ec:9d:d3:eb:18 brd ff:ff:ff:ff:ff:ff
16: imq0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc htb state UNKNOWN group default qlen 32
    link/ether ee:50:c3:36:21:41 brd ff:ff:ff:ff:ff:ff
17: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1400 qdisc pfifo_fast state UNKNOWN group default qlen 500
    link/none 
    inet 10.137.95.1/24 brd 10.137.95.255 scope global tun0
       valid_lft forever preferred_lft forever
18: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none

The second output shows the status when the VLAN NIC is connected to uplink port of my switch:

[root@ipfire ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: green0p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master green0 state UP group default qlen 1000
    link/ether a8:b8:e0:03:47:ad brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether a8:b8:e0:03:47:ae brd ff:ff:ff:ff:ff:ff
4: orange0p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master orange0 state UP group default qlen 1000
    link/ether a8:b8:e0:03:47:af brd ff:ff:ff:ff:ff:ff
5: blue0p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master blue0 state UP group default qlen 1000
    link/ether a8:b8:e0:03:47:b0 brd ff:ff:ff:ff:ff:ff
6: red0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc htb state UP group default qlen 1000
    link/ether a8:b8:e0:03:47:b1 brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.134/16 scope global red0
       valid_lft forever preferred_lft forever
7: eth5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether a8:b8:e0:03:47:b2 brd ff:ff:ff:ff:ff:ff
8: green0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 02:47:22:b3:c4:c3 brd ff:ff:ff:ff:ff:ff
    inet 172.20.99.1/16 scope global green0
       valid_lft forever preferred_lft forever
9: green0p1@eth5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master green0 state UP group default qlen 1000
    link/ether 02:9f:2e:ac:ac:40 brd ff:ff:ff:ff:ff:ff
10: blue0p1@eth5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master blue0 state UP group default qlen 1000
    link/ether 02:68:7b:61:9f:96 brd ff:ff:ff:ff:ff:ff
11: orange0p1@eth5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master orange0 state UP group default qlen 1000
    link/ether 02:aa:a8:f0:88:1e brd ff:ff:ff:ff:ff:ff
12: blue0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 02:76:6a:d1:9e:ee brd ff:ff:ff:ff:ff:ff
    inet 172.21.0.1/16 scope global blue0
       valid_lft forever preferred_lft forever
13: orange0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 02:ac:0b:98:c7:a0 brd ff:ff:ff:ff:ff:ff
    inet 172.19.0.1/16 scope global orange0
       valid_lft forever preferred_lft forever
14: ifb0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 32
    link/ether b6:45:ba:03:42:24 brd ff:ff:ff:ff:ff:ff
15: ifb1: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 32
    link/ether 52:ec:9d:d3:eb:18 brd ff:ff:ff:ff:ff:ff
16: imq0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc htb state UNKNOWN group default qlen 32
    link/ether ee:50:c3:36:21:41 brd ff:ff:ff:ff:ff:ff
17: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1400 qdisc pfifo_fast state UNKNOWN group default qlen 500
    link/none 
    inet 10.137.95.1/24 brd 10.137.95.255 scope global tun0
       valid_lft forever preferred_lft forever
18: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none

Regards

MC

alexand · 8 September 2026 15:17

MC Chicken:

I tried I tried already some different configurations and rebooted every time. But this did not really change anything.

To adopt the new manageable switch in my network, I connected it to one port of my standard switch. Then I assigned a fixed IP address from the green zone and configured the ports. Both uplink ports are tagged as trunk ports for VLAN 2, 3, 4. The other eight ports are access ports.

As long as I connect one uplink port to a port of my standard switch the configuration software shows the status “connected”. When i connect the uplink port to the VLAN NIC of IPFire the status of the switch changes to “disconnected”. All other ports are not yet used. Therefore, a loop should not be an issue.

I am not sure if it is useful. I used the terminal to check the status of the interfaces.

The first output shows the status when the VLAN NIC is not connected:

According to In my opinion, this configuration is a bit overcomplicated.
I suggest making one physical interface to RED and making an 802.1q trunk with Green, Blue, Orange on the next one.
And receive everything on the switch (there, assign appropriate zones to specific switch ports)
Unless you lack physical ports to connect hosts.
This is of course my opinion and may not suit you.

chickenmc · 8 September 2026 15:42

Hi @alexand ,

I agree that it may seem to be a little bit complicated. But I do not want to rearrange my existing private network installation.

For my work I need the manageable switch because I have to test IoT devices in various network configurations. Also it should be possible to disconnect the complete work installation with one simple mechanical switch.

ag · 9 September 2026 11:53

Hi @chickenmc

IPFire appears to be working normally here. That ip a output shows the extra NIC working.

Unplugged, eth5 has no carrier and the VLAN interfaces are down. Plugged in, eth5 is up, and green0p1@eth5, blue0p1@eth5 and orange0p1@eth5 are up on their bridges. So the Zone Configuration is doing what it should.

eth5 itself has no IP and is not in a bridge. GREEN, BLUE and ORANGE on that cable are carried as tagged VLANs 2, 3 and 4.

The switch showing as “disconnected” therefore looks more like a switch management VLAN issue. As it was initially managed through the old untagged GREEN network, its management interface may still be on the native/untagged VLAN.

If so, set the switch management VLAN to 2 (GREEN), use 172.20.99.1 as its gateway, and keep the IPFire-facing port tagged for VLANs 2, 3 and 4. Then try managing it from GREEN again.

If the management VLAN is already set to 2, the next thing to check would be the switch model and its native/PVID settings.

Thanks,
A G