# adding vlans



## zader (Oct 19, 2021)

Hi all,

In this case I have set up 2 totally separate sets of jails on 2 nics using 2 networks.

/etc/rc.conf


```
gateway_enable="YES"

# configure igb0 and igb1 with wan access
ifconfig_igb0_name="igb0wan"
ifconfig_igb1_name="igb1wan"
ifconfig_igb0wan="up"
ifconfig_igb1wan="up"

# define clones

cloned_interfaces="bridge0 bridge1 bridge2 bridge3"

# define igb0/1 wanbridges

ifconfig_bridge0_name="igb0wanbridge"
ifconfig_bridge1_name="igb1wanbridge"

# define private bridges for lo1 and lo2

ifconfig_bridge2_name="igb0pbridge"
ifconfig_bridge3_name="igb1pbridge"

# bring bridges online

ifconfig_igb0wanbridge="addm igb0wan up"
ifconfig_igb1wanbridge="addm igb1wan up"
```


this configuration renames igb0/1 to igb0wan and igb1wan
it binds them to the bridge and binds each network to its own epair


resulting in this



```
+-----+------------------+-------+--------------+---------------------------+
| JID | NAME | STATE | RELEASE | IP4 |
+=====+==================+=======+==============+===========================+
| 6 | igb0-application | up | 13.0-RELEASE | 172.16.24.100 |
+-----+------------------+-------+--------------+---------------------------+
| 2 | igb0wan | up | 13.0-RELEASE | 10.100.10.144,172.16.24.1 |
+-----+------------------+-------+--------------+---------------------------+
| 7 | igb1-application | up | 13.0-RELEASE | 10.10.10.100 |
+-----+------------------+-------+--------------+---------------------------+
| 3 | igb1wan | up | 13.0-RELEASE | 10.100.10.143,10.10.10.1 |
+-----+------------------+-------+--------------+---------------------------+
```

as expected the wan jails can ping the internet and ping the .100 application jails.. where as the application jails can only ping other jails on the internal network, they can not ping the internet or any other jails not on their network.

first question..

Is this the "best" approach?

second question..

how do I make the application jails tag their traffic as say vlan 10 and 20 so the output of said application servers can be easily routed by upstream switches?


thanks


----------

