[RFI - 802.1Q driver] packet ingress policy/filter?


As far as I can tell OpenWrt uses ip link add link $netdev name $1 type vlan id $vid to create


with 802.1Q VLAN Support being the driver for that virtual interface

[1] stipulates such as

802.1q tagged virtual LAN interface

On such interface:

  • ethX.VID being slaved off the master/parent device ethX
  • ingress 802.1Q-encapsulated frames on ethX with a VID are being untagged, then re-presented to the network stack as untagged ingress frames on ethX.VID
  • egress frames on ethX.VID are being 802.1Q tagged with associated VID, then passed to ethX for transmission


  1. what happens with untagged ingress frames on ethX? (expect dropping)

  2. what happens with 802.1Q tagged but none-associated VID ingress frames on ethX? (expect dropping)

  3. if as expected those frames are being dropped than how come ethX.VID on the WAN port works when the ingress frames however are untagged?

  4. With [2] stipulating:

When you bridge non-VLAN and VLAN interfaces together, the system takes care about adding VLAN ID when sending packet from non-VLAN to VLAN interface, and it automatically removes the VLAN ID when sending packet from VLAN interface to non-VLAN one.

[a] which part of the system is the caretaker since it would not appear to be a common functionality for a Linux bridge device, or is it?
[b] what happens in this context when bridging a driver-level VLAN with a DSA interface?

[1] https://www.linux.org/docs/man8/ip-link.html
[2] https://openwrt.org/docs/guide-user/network/vlan/switch_configuration