The Physical Cabling Bottleneck
In traditional enterprise networks, separating traffic for security reasons required physical hardware. If you wanted an Ubuntu server to act as a bridge between the public DMZ (Demilitarized Zone) network and the secure internal database network, you had to physically install two separate Network Interface Cards (NICs) into the server and run two physical ethernet cables to two different physical switches.
Modern data centers utilize Virtual LANs (VLANs). VLANs use the 802.1Q networking standard to mathematically separate traffic on a single physical cable. The network switch tags packets with a specific VLAN ID (e.g., VLAN 10 for DMZ, VLAN 20 for Database). A single physical ethernet cable running to an Ubuntu server can carry traffic for dozens of isolated networks simultaneously.
However, for the Ubuntu server to understand this tagged traffic, you must configure virtual network interfaces in the operating system. In modern Ubuntu releases, the legacy /etc/network/interfaces file has been completely replaced by Netplan. Netplan is a powerful, YAML-based configuration engine that allows administrators to declaratively build complex VLAN trunks and bonded interfaces with a few lines of code.
Step 1: Identifying the Physical Interface
Before you can build virtual VLAN interfaces, you must identify the exact name of the physical network card (the “trunk” port) that is receiving the tagged traffic from the switch.
Run the IP utility:
ip link showYou will see the loopback interface (lo) and your primary physical interface. On modern Ubuntu systems using predictable network interface names, this is rarely eth0. It will likely be named something like ens33 or enp3s0.
For this tutorial, assume the physical trunk interface is ens33.
Step 2: Understanding the Netplan YAML Structure
Netplan configurations are stored in the /etc/netplan/ directory. There is usually a default file named 00-installer-config.yaml or 50-cloud-init.yaml.
Netplan uses strict YAML formatting. Warning: YAML absolutely forbids the use of Tab characters. You must use spaces for indentation, or the configuration will instantly crash.
Open the configuration file using your preferred text editor (e.g., sudo nano /etc/netplan/00-installer-config.yaml).
A standard, non-VLAN configuration looks like this:
network:
version: 2
ethernets:
ens33:
dhcp4: trueStep 3: Creating the VLAN Interfaces
Suppose your network engineer has configured the physical switch port connected to ens33 as a “Trunk.” They are sending untagged management traffic on the native VLAN, tagged DMZ traffic on VLAN 10, and tagged Database traffic on VLAN 20.
You must modify the Netplan file to define these virtual interfaces. The architecture requires you to define the physical ethernets block first, and then create a new vlans block that references the physical card.
network:
version: 2
ethernets:
ens33:
# This configures the native, untagged management IP
addresses:
- 192.168.1.50/24
routes:
- to: default
via: 192.168.1.1
nameservers:
addresses: [8.8.8.8, 1.1.1.1]
vlans:
vlan10:
id: 10
link: ens33
addresses:
- 10.0.10.5/24
vlan20:
id: 20
link: ens33
addresses:
- 10.0.20.5/24Decoding the Logic:
vlans:This creates a new block for virtual interfaces.vlan10:The internal name for the virtual interface in Ubuntu. It is best practice to name it based on the ID.id: 10The crucial 802.1Q tag. The Linux kernel will use this ID to strip the tag off incoming packets and route them to this virtual interface.link: ens33This is the physical anchor. It tells the virtual interface which physical network card to use for transmission.addresses:The static IP address assigned to the virtual network. (Notice there is no default gateway defined on the VLANs, as a server should generally only have one default route).
Step 4: Validating and Applying the Configuration
Because a single syntax error in a YAML file can completely sever your SSH connection to the server, Netplan includes a brilliant validation engine.
Do not simply apply the file. Run the try command:
sudo netplan tryThis command attempts to apply the configuration. If you made a syntax error (like using a Tab instead of spaces), it will instantly reject it and tell you exactly which line failed.
If the syntax is correct, Netplan applies the networking changes and starts a 120-second countdown.
Configuration accepted.
Press ENTER to keep these settings.
Configuration will revert in 120 seconds.If your VLAN configuration accidentally broke your SSH connection, your terminal will freeze. You do nothing. After 120 seconds, Netplan automatically reverts to the old configuration, your SSH session unfreezes, and the server is saved from being permanently isolated. If everything works perfectly, press ENTER to commit the changes permanently.
Step 5: Verifying the Live Interfaces
Once applied, use the standard IP utilities to verify the virtual interfaces were created.
ip link showYou will now see new interfaces named vlan10@ens33 and vlan20@ens33. To verify the IP addresses:
ip addr show vlan10The Ubuntu kernel is now actively listening for 802.1Q tagged frames on the physical wire. When a packet tagged with “10” arrives, the kernel strips the tag and forwards the raw packet to the vlan10 virtual interface, allowing the Nginx or PostgreSQL service listening on that specific interface to process the data securely.
Conclusion
Physical network separation is obsolete in the era of virtualized data centers. By leveraging the Netplan configuration engine on Ubuntu, system administrators can programmatically define complex 802.1Q VLAN topologies. A single, declarative YAML file transforms a single physical network card into a massive trunk port, securely routing dozens of isolated networks into specific virtual interfaces without risking the catastrophic syntax errors of legacy network scripts.