Segregate one VLAN from rest of network

Hi all, I have one machine with 2 NICs (Red and Green) running IPFire. NIC1 is Red and is connected to WAN, NIC2 is Green and is connected to a managed switch and serves my home network.

I now need to add a work firewall device to my home network, which will tunnel to my office network behind the scenes.

The plan was to create a separate VLAN on the swtich for this traffic, and put it on a separate subnet using the Blue zone. Home traffic would all traverse over NIC2 Green (, work traffic would traverse over NIC2 Blue (, and the two would not be able to interact. After going through the forums, I’m seeing lots of people struggling with VLAN traffic when they have fewer NICs than zones, and I have a similar question.

Can this be done with IPFire and 2 NICs?


Yes run setup to add blue.
Then from WUI set vlan.

Thanks for the quick reply!

Here’s my initial setup, but not having any luck yet. My first assumption would be to set the blue zone to VLAN 2 (My work network VLAN) on same same NIC as the Green zone, since they’re physically on the same NIC. I’ve also disabled the Blue zone MAC filtering with a rule. So far I’m not getting any connection from any device on that VLAN though:

A followup question as well. Once I can get devices connecting on Blue (which I’m still not sure what this issue is there), will DHCP pick them up even though Blue has a different subnet defined, or will they need to be static IPs?

Followup to the previous question, I don’t seem to have a DHCP server availble to enable on Blue. Is that not possible without a physical NIC? Ideally Blue (and the associated VLAN devices) would have their own DHCP server for the range.

When you ran setup
Did you set up the ip and DHCP?
May need to run setup again.

Yep I did, in fact I just reinstalled from scratch to be sure. Core 170 (which is my first foray into IPFire).

I have 2 NICs, chose “Red, Green, Blue” network, selected the NICs for red and green, and left Blue empty. I configured an IP for Green and Blue, and set Red to DHCP. Setup reminded me that I hadn’t chosen a NIC for Blue, and I chose ignore.

Both times now I haven’t had a DHCP option for Blue in the WUI. In fact, now that I think of it I haven’t been prompted for a DHCP range for Blue at all during the setup process, only for Green. Could it be a bug I’m running into? Would anyone be able to confirm if they get asked for options for a Blue DHCP server if they configure the way I do on Core 170?

ip address show

What do you see?

When you are installing then you only ever get asked to enter the dynamic dhcp address range for Green. It is never asked for Blue.

The aim is that this gives you access for a computer on Green to open up the WUI. Then from their you can set up the dhcp settings for both Green and Blue, if present.

I have never tried what you are trying and don’t know if it should work the way you are finding or not.

I will try it out on my vm testbed system but that will have to wait for some other evaluations that are ongoing currently. Will get back once I have been able to test it out.

1 Like

I have entries for green0 and red0, but nothing mentioning blue (because I chose Ignore and didn’t assign anything to that zone?).

In the WUI, setting the Blue zone to VLAN on the Green NIC doesn’t seem to change that.

Try “Default” instead of “Bridge” for the blue zone.

Also maybe you should post the content of these two files (hide the sensitive info, including the mac address).

1 Like

Yep I did try setting to Default early on, I took the screenshot early on in the process.

Contents of /var/ipfire/ethernet/vlans (MACs covered):


Contents of /var/ipfire/ethernet/settings:

RED_DESCRIPTION='"pci: Intel Corporation Ethernet Connection I219-LM (rev 21)"'
GREEN_DESCRIPTION='"pci: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 0c)"'

Strangely, that Blue MAC address doesn’t exist on the system at all and I certainly didn’t enter it, unless the system creates it as a placeholder or something?

[root@router ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet scope host lo
       valid_lft forever preferred_lft forever
2: green0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc cake state UP group default qlen 1000
    link/ether 00:01:2e:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet scope global green0
       valid_lft forever preferred_lft forever
3: red0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc cake state UP group default qlen 1000
    link/ether 00:01:2e:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet brd scope global dynamic noprefixroute red0
       valid_lft 250377sec preferred_lft 207177sec
4: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc cake state DOWN group default qlen 1000
    link/ether 0c:54:15:xx:xx:xx brd ff:ff:ff:ff:ff:ff

No blue device created (BLUE_DEV=). Why? Maybe you should open a bug report.

I managed to get some time today to do an install of red green and blue on 2 nics on my vm testbed.

I was able to successfully end up with a green network and a blue vlan network on the same network interface and ended up with both red and green dhcp options.


The process I used was as follows.

Set up a vm with 2 nics. Ran install from CU170 iso.

Selected red, green and blue network type.

Assigned green and red to the two interfaces, selected ignore for the fact that blue flagged as not being assigned.

System booted and I went into the WUI.

The dhcp page only had the green option.
On the Zone Configuration page I added the Blue zone as a VLAN with an VLAN ID and pressed save. It then said to reboot which I did.

Then I went into the console and ran setup again and this time when selecting blue it had an interface available, which is the blue0 on green0 vlan shown as blue0@green0 interface on the ip address show output.

Having selected blue to the new interface I then exited from setup and went back to the WUI and now on the dhcp page I had both green and blue dhcp options. I then added in the blue dynamic range and enabled it.

Then rebooted again just to be certain and everything stayed with green and blue on dhcp and zone configuration with green and blue on vlan and ip address show giving the same output.


Bridge or default?

this is possibly the crucial step that was missing by the OP,

This tutorial form @bonnietwin should be made in a wiki page, considering how many thread we get for VLAN configuration.


I set it to Default. See the zone configuration screenshot

My stupid brain sometimes ignore things that are gigantic. My apologies.

Don’t worry about it. I have done the same thing myself.
It’s better to ask than to miss something important.

1 Like

I would defintely second adding that to the wiki… I haven’t seen any mention of needing to go back into setup anywhere online.

However, in my screenshot above, I’m definitely not getting the blue0@green0 device after configuring the blue zone to vlan in the WUI, nor am I able to select it when re-running setup. The only difference is that I have a wlan0 device that I’m not using… Since I don’t need it I’ll try physically removing the device and see if that makes a difference, to eliminate any potential for a device detection bug involving it.

1 Like

After you selected blue to vlan did you press save. You need to press save and then you need to reboot before going into setup.