How to Configure VLAN Trunking on Windows 11 Hyper-V Adapters Using PowerShell

When running advanced networking appliances\u2014such as virtual firewalls (pfSense, OPNsense), virtual routers, network monitoring probes, or multi-tenant containers\u2014inside Hyper-V on Windows 11, a virtual machine often needs to process traffic across multiple virtual local area networks (VLANs). If you rely on standard Hyper-V access-mode settings, the virtual switch strips or tags VLAN IDs on ingress and egress, requiring administrators to create separate virtual network adapters for every individual VLAN. To allow an individual virtual network adapter to receive, route, and inspect raw IEEE 802.1Q tagged frames across multiple subnets, Hyper-V supports VLAN Trunking, configurable via PowerShell.

Understanding Hyper-V VLAN Modes: Access vs Trunk

Hyper-V supports three primary VLAN operational modes on virtual network adapters:

• Access Mode: The default mode for standard virtual machines. All traffic departing the VM is tagged with a single designated VLAN ID by the virtual switch. Traffic arriving with that VLAN ID has its 802.1Q header stripped before delivery to the VM\u2019s operating system.
• Trunk Mode: The virtual switch forwards tagged Ethernet frames directly into the virtual machine without stripping headers. The guest operating system\u2019s network stack (such as a Linux router or pfSense WAN/LAN interfaces) processes the individual 802.1Q VLAN tags directly.
• Native VLAN ID: Designates which VLAN ID is assigned to untagged frames entering the trunk port.
• Allowed VLAN ID List: A whitelist restricting which specific VLAN tags are permitted to traverse the trunk link (e.g., VLANs 10, 20, and 30).

Inspecting Current Virtual Network Adapter VLAN Settings

Open PowerShell with administrative privileges and query the VLAN configuration of your target virtual machine (e.g., "RouterVM"):

Get-VMNetworkAdapterVlan -VMName "RouterVM"

By default, newly created virtual machine adapters report:

VMName   VMNetworkAdapterName Mode   AccessVlanId NativeVlanId AllowedVlanIdList
------   -------------------- ----   ------------ ------------ -----------------
RouterVM Network Adapter      Untagged 0            0

An Untagged mode indicates that no VLAN tagging or trunking is active.

Configuring 802.1Q VLAN Trunking via PowerShell

To convert the virtual network adapter to Trunk mode and allow specified VLANs to pass directly into the guest virtual machine:

Set-VMNetworkAdapterVlan -VMName "RouterVM" -Trunk -AllowedVlanIdList "10,20,30-40" -NativeVlanId 1

The parameters operate as follows:

• -Trunk: Switches the virtual switch port from Access or Untagged mode to 802.1Q Trunk mode.
• -AllowedVlanIdList: Specifies permitted VLAN tags. You can declare individual comma-separated numbers (10,20) or continuous ranges (30-40). Any frame tagged with a VLAN ID outside this list is dropped at the virtual port.
• -NativeVlanId: The VLAN ID associated with untagged traffic. Packets generated by the guest VM without an explicit 802.1Q tag are automatically mapped to VLAN 1 by the switch.

To verify the new trunking state:

Get-VMNetworkAdapterVlan -VMName "RouterVM"

The output confirms:

VMName   VMNetworkAdapterName Mode  AccessVlanId NativeVlanId AllowedVlanIdList
------   -------------------- ----  ------------ ------------ -----------------
RouterVM Network Adapter      Trunk 0            1            10,20,30-40

Configuring Guest Operating System Sub-Interfaces

With trunking active on the Hyper-V host, configure matching virtual sub-interfaces inside the guest operating system:

On a Linux guest VM, create 802.1Q sub-interfaces for VLAN 10 and VLAN 20:

sudo ip link add link eth0 name eth0.10 type vlan id 10
sudo ip link add link eth0 name eth0.20 type vlan id 20
sudo ip link set dev eth0.10 up
sudo ip link set dev eth0.20 up

The Linux kernel decapsulates tagged traffic arriving from the Hyper-V trunk, routing each VLAN stream to its dedicated network namespace or interface.

Reverting from Trunk Mode to Access or Untagged Mode

If you decommission your virtual router and wish to return the virtual network adapter to standard access mode tagged with a single VLAN (e.g., VLAN 10):

Set-VMNetworkAdapterVlan -VMName "RouterVM" -Access -VlanId 10

To completely remove all VLAN tagging and restore default untagged networking:

Set-VMNetworkAdapterVlan -VMName "RouterVM" -Untagged

The virtual port resets instantly without interrupting VM power state, restoring default flat network connectivity.