How to Configure 802.1Q VLANs and Virtual Network Interfaces in macOS

Network engineers, systems architects, and lab administrators frequently require a Mac to communicate across multiple segregated subnets simultaneously—such as isolated management networks, storage SANs, VoIP subnets, and guest tiers. Connecting separate physical network adapters for each isolated segment is cumbersome and impractical on modern MacBooks and Mac Studio workstations.

macOS includes full native support for IEEE 802.1Q Virtual Local Area Networks (VLANs). By configuring a VLAN trunk on your physical Ethernet or Thunderbolt network interface, macOS can tag network packets with specific VLAN IDs, creating dedicated virtual network adapters that communicate across multiple virtual subnets through a single physical cable.

Method 1: Configuring 802.1Q VLANs via macOS System Settings

To configure a VLAN interface graphically in modern macOS (Sonoma, Sequoia, and later):

1. Connect your Mac to an 802.1Q-enabled switch port configured in Trunk mode.
2. Open System Settings from the Apple menu ().
3. Select Network from the left navigation panel.
4. At the bottom right of the Network pane, click the ellipsis (…) button next to the Add Service button.
5. Select Manage Virtual Interfaces… from the pop-up menu.
6. Click the Add (+) button at the bottom left of the virtual interfaces sheet and choose New VLAN…
7. Configure the VLAN parameters:
   • VLAN Name: Enter a recognizable label (e.g. VLAN 10 – Management).
   • VLAN ID (Tag): Enter the integer tag number configured on your switch (e.g. 10).
   • Interface: Select the physical parent adapter carrying the trunk (e.g. Ethernet or Thunderbolt Ethernet).
8. Click Create, then click Done.

The new VLAN appears as an independent network adapter under the Network settings list. Click on it to configure its IP addressing (DHCP or static IP assignment), DNS search domains, and proxy rules.

Method 2: Configuring 802.1Q VLANs via Terminal Using networksetup

For system automation, remote administration, and shell scripts, macOS includes complete VLAN management capabilities inside the networksetup command-line utility:

1. Identifying the Parent Hardware Port

List all physical network ports and their device nodes:

networksetup -listallhardwareports

Locate the target Ethernet interface. For example:

Hardware Port: Ethernet
Device: en0
Ethernet Address: 00:3e:e1:c4:a2:15

2. Creating a VLAN Interface

To create a VLAN with tag 20 named VLAN20_DMZ bound to physical device en0:

# Syntax: sudo networksetup -createVLAN <name> <parent_device> <vlan_tag>
sudo networksetup -createVLAN "VLAN20_DMZ" en0 20

macOS immediately spawns a new virtual network device node (such as vlan0 or en0.20).

3. Assigning Static IP Addressing to the VLAN

Configure the newly created virtual network service with an IP address, subnet mask, and router gateway:

sudo networksetup -setmanual "VLAN20_DMZ" 10.20.0.50 255.255.255.0 10.20.0.1
sudo networksetup -setdnsservers "VLAN20_DMZ" 10.20.0.1 1.1.1.1

4. Listing and Auditing Active VLANs

To inspect all currently registered VLAN interfaces on the system:

networksetup -listVLANs

Output example:

VLAN: VLAN20_DMZ
    Parent Device: en0
    Tag: 20
    Device: vlan0

5. Deleting a VLAN Interface

To remove a virtual VLAN adapter when testing is complete:

sudo networksetup -deleteVLAN "VLAN20_DMZ" en0 20

Verifying Tagged Traffic with tcpdump

To confirm that your Mac is transmitting and receiving 802.1Q tagged frames properly, run tcpdump on the parent interface filtering for 802.1Q encapsulation:

sudo tcpdump -i en0 -e -nn vlan 20

The capture displays live packet frames tagged with vlan 20, verifying flawless trunk segmentation on macOS.