How to Create and Configure 802.1Q VLAN Interfaces in Linux Using ip link

In enterprise networking, multi-tenant virtualisation, and lab environments, segmenting network traffic without deploying dedicated physical network cables is standard practice. IEEE 802.1Q virtual local area networks (VLANs) achieve this by inserting a 4-byte VLAN tag into Ethernet frames, enabling multiple isolated broadcast domains over a single physical network interface card (NIC).

The Linux kernel features comprehensive native support for 802.1Q tagged VLANs through the modern iproute2 suite. Using the ip link command, system administrators can instantly instantiate, configure, and tear down VLAN sub-interfaces without relying on outdated legacy utilities like vconfig. Here is how to create, inspect, and manage 802.1Q VLAN interfaces in Linux using ip link.

Understanding Linux VLAN Interfaces and 802.1Q Tagging

When Linux receives Ethernet frames containing an 802.1Q header on a physical parent interface (such as eth0 or enp3s0), the kernel inspects the 12-bit VLAN Identifier (VID, ranging from 1 to 4094). If a corresponding VLAN sub-interface exists, the kernel strips the tag and forwards the unencapsulated payload to that virtual interface. Conversely, outbound frames transmitted through the VLAN sub-interface are automatically encapsulated with the assigned tag before leaving the physical wire.

Common naming conventions for VLAN interfaces include:

• Interface-Dot-VID (Standard): eth0.10 or enp3s0.100 (explicitly indicating the parent device and VLAN ID).
• Descriptive Custom Names: vlan100, dmz_vlan, or mgmt_net.

Step 1: Verify the Physical Parent Interface

Before creating a VLAN interface, verify that your underlying physical network interface is active and linked:

ip link show dev eth0

Ensure the parent interface state is UP. If it is currently down, bring it up using:

sudo ip link set dev eth0 up

Step 2: Create an 802.1Q VLAN Interface Using ip link

To create a tagged VLAN interface, execute ip link add, specifying the parent link, the desired sub-interface name, and the 802.1Q VLAN ID:

sudo ip link add link eth0 name eth0.100 type vlan id 100

In this command:

• link eth0: Designates the underlying physical parent NIC where tagged trunk traffic arrives.
• name eth0.100: Defines the name of the new virtual network device.
• type vlan id 100: Instructs the kernel driver to handle 802.1Q tagging using VLAN ID 100.

Step 3: Assign an IP Address and Bring the VLAN Interface Up

Once created, the VLAN sub-interface behaves like a standard network card. Assign an IP address and subnet mask, then bring the interface online:

sudo ip addr add 192.168.100.25/24 dev eth0.100
sudo ip link set dev eth0.100 up

Verify that the IP assignment and operational state are active:

ip addr show dev eth0.100

You can now test connectivity to remote hosts or gateways residing on VLAN 100 using ping.

Step 4: Inspect Detailed VLAN Interface Properties

To view detailed 802.1Q kernel parameters—including protocol flags, ingress/egress Quality of Service (QoS) mappings, and reordering settings—use the -d (details) flag:

ip -d link show dev eth0.100

The output will display the explicit VLAN configuration stanza:

eth0.100@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT
    link/ether 00:1a:2b:3c:4d:5e brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 0 maxmtu 65535
    vlan protocol 802.1Q id 100 <REORDER_HDR> addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size 65536

Advanced: Configuring Egress QoS Priority Mappings

In networks utilising 802.1p traffic prioritisation, the 802.1Q tag includes a 3-bit Priority Code Point (PCP) field (values 0 through 7). You can map Linux internal socket priorities to egress 802.1p tags when instantiating the interface:

sudo ip link add link eth0 name eth0.200 type vlan id 200 egress-qos-map 0:1 1:2 2:5

This command configures Linux socket priority 0 to egress with 802.1p priority 1, socket priority 1 to egress with priority 2, and socket priority 2 with priority 5, ensuring voice and mission-critical packets receive proper treatment across trunk switches.

Step 5: How to Delete a VLAN Interface

When a VLAN sub-interface is no longer needed, tear it down cleanly using ip link delete:

sudo ip link set dev eth0.100 down
sudo ip link delete eth0.100

Deleting the virtual sub-interface does not disrupt the underlying physical parent NIC (eth0) or any other sibling VLANs operating on it.

Persisting VLAN Interfaces Across System Reboots

Commands executed via ip link configure runtime kernel structures that vanish upon reboot. To make your VLAN configuration permanent, use your distribution’s network manager:

Netplan (Ubuntu / Debian)

In Ubuntu 20.04, 22.04, and 24.04 LTS, add a vlans section inside your configuration file (e.g. /etc/netplan/01-netcfg.yaml):

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      dhcp4: no
  vlans:
    eth0.100:
      id: 100
      link: eth0
      addresses:
        - 192.168.100.25/24
      routes:
        - to: default
          via: 192.168.100.1

Apply the configuration using sudo netplan apply.

systemd-networkd (Arch Linux, Debian, Fedora, Alpine)

1. Edit the parent network file /etc/systemd/network/10-eth0.network to bind the VLAN:

[Match]
Name=eth0

[Network]
VLAN=eth0.100

2. Create a netdev definition in /etc/systemd/network/20-eth0.100.netdev:

[NetDev]
Name=eth0.100
Kind=vlan

[VLAN]
Id=100

3. Create the VLAN network profile in /etc/systemd/network/30-eth0.100.network:

[Match]
Name=eth0.100

[Network]
Address=192.168.100.25/24
Gateway=192.168.100.1

Restart the network manager with sudo systemctl restart systemd-networkd to commit your persistent configuration.