Hi,

I want to create a guest VM with a single bridge (br0) and I want it to talk untagged traffic and tagged traffic using vlans 11 and 22. The subnets are:
· 192.168.0.0/24 untagged
· 192.168.11.0/24 tag 11
· 192.168.22.0/24 tag 22

From the Host where I create the VM, I use the following commands to create the bridge.
--------------------------------------------------
ip link add name eth1.11 link eth1 type vlan id 11
ip link set eth1.11 up
ip link add name eth1.22 link eth1 type vlan id 22
ip link set eth1.22 up

brctl addbr br0
brctl addif br0 eth1
brctl addif br0 eth1.11
brctl addif br0 eth1.22

ip addr add 192.168.0.100/24 broadcast 192.168.0.255 dev br0
ip addr add 192.168.11.100/24 broadcast 192.168.11.255 dev br0 label br0:11
ip addr add 192.168.22.100/24 broadcast 192.168.22.255 dev br0 label br0:22

--------------------------------------------------

So far, everything ok. I can ping other IPs in vlans 11 and 22 from that bridge (e.g. ping -I br0 192.168.11.3) and also untagged network (e.g. ping -I br0 192.168.0.5).

Then I use that br0 to create a VM. That VM has eth0 and I create eth0.11 and eth0.22 and assign IPs to the 3 interfaces. The VM can ping the untagged network but not the tagged ones.

What am I missing?

I will answer to my own question.

I fix it by creating the vlan interfaces at the bridge level, not at the physical interface level:

--------------------------------------------------
brctl add br0
brctl add eth1

ip link add name br0.11 link br0 type vlan id 11
ip link add name br0.22 link br0 type vlan id 22

ip addr add 192.168.0.100/24 broadcast 192.168.0.255 dev br0
ip addr add 192.168.11.100/24 broadcast 192.168.11.255 dev br0.11
ip addr add 192.168.22.100/24 broadcast 192.168.22.255 dev br0.22
--------------------------------------------------

And inside the VM also I create the vlan interfaces and then I do tagging from the VM which is what I wanted.