# bhyve, PPPoE: tap device drops vlan tags



## PMc (Jul 31, 2021)

I wanted to do this, but it didn't work:


```
WIRE --- fxp0                        Here is all traffic
           |  \
           |   vlan0 vlan=7           Here is only traffic with vlanid=7
           |
         ng_bridge                    All traffic gets bridged to tap1
           |
          tap1 -                      This connects to the guest
               |
             vtnet1                   Here the traffic is without vlanid!
                 \
                  vlan0 vlan=7        no traffic at all visible here!
```

The task: from the WIRE come vlan tagged data, and I must respond with equally tagged data. And I want to do this in bhyve (doing it in VIMAGE jail works fine, but there is no dummynet). 
It appeared to me that bhyve removes the vlan tag when passing a packet into the guest via virtio-net. But this is not the case, a test setup works fine transferring tagged data in and out of the guest. 

So, I hacked along and came up with a workaround, doing the tagging/untagging outside of the guest, like this, and that worked:


```
WIRE --- fxp0                        Here is all traffic
           |  \
           |   vlan0 vlan=7           Here is only traffic with vlanid=7
           |
         bridge                       All traffic gets bridged
           |
         ng_vlan                      Arbitrary vlan-filter
            \
             \vlan=7                  Here only traffic from vlanid=7
              \                                  (with vlantag removed)
              tap1 -                  This connects to the guest
                   |
                   -  vtnet1          No need for a vlan0 netif here.
```

Further on, I wanted to know what precisely goes wrong. I found lots of posts everywhere describing problems of failing vlan communication between host and guest, but none of them gives precise data from e.g. tcpdump showing what actually goes wrong. They just say, cannot connect.  

What I finally found out: when I connect a normal interface to a bridge, it will get the vlan tags. But when I connect a tap interface to a bridge or hub (netgraph), it does not get the vlan tags. So that seems to be a bug in the tap device.


----------

