From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 906501FF0AA for ; Tue, 03 Nov 2026 13:28:50 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 218B92184B; Tue, 03 Nov 2026 13:28:47 +0100 (CET) From: Matthis Eicher Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3901.200.71.1.16\)) Subject: [RFC] network: expose per-port VLAN settings (bridge-access, bridge-pvid, bridge-vids) for bridge ports Message-Id: Date: Sun, 1 Nov 2026 20:00:29 +0100 To: pve-devel@lists.proxmox.com X-Mailer: Apple Mail (2.3901.200.71.1.16) X-Provags-ID: V03:K1:kHDjBuCyw8983vGP3Fz25gOXcD4MvWgmTTep1PE54flFdaKuAMC 5ZoiFCOTE2vD8bNgxvISu+es20N+j7cUFF1eVZE4mMyk6jfbgOyE/NZyNKbu6akrURnMycJ 9OJgvFmopUUbPMVFLnI4wKe9rSwio5AyfsVqiJvTHUwzI9rF4wCdOgiLTmti8y2nYun0ZfB P1Xosi5K5bhNy/EgZHf4Q== X-Spam-Flag: NO UI-OutboundReport: notjunk:1;M01:P0:F+UpXHCsWd0=;9FE5TCG05Gd/dIc5Wev9zY6XSXd E9ht60IJJwxkzqPKQOYiBLJK8vZwSh0trx2KVKEWZQkzsTHRmXvsR8svqOcF0Is56T8rWY0lO 44xFbkT9e/N83JEMlhiF5v9NctnniLa7pcRxVSqCNMG61wLphFHfemtVOtAl9L2nfdejoEseM NUK+sPaFnNbz68lEbuYAD+CJx9lvCbc0KGWZbcDG/VWcMI8GDncSeqDEeeLVnA5iDabRQRbHJ dBbeS/acODpZUhNG/uRcbj1XcOWQtsl+pM6MgGwRi49bnG05vrA/627jf5rDCT85TLGbfZKDU SO20Oeu1j68ntk03SVFZRJjvgBEZMzSsmFZdPj3Aqzz1R+G35B+YV7RMWVpitu8z0DDttAaLp JzqNvZCFji62XCA7d2A/yeESJqooXpHTPAOnK/XWH4EPfNJ1+3ZFu0tMeEH8Nk06IPOw7BMpF g4ZXaPXwyYNzeL1oFp5TgJxILHH9P1yZRsX3TND+xntkYWe7w2urzscFbfkz1L+LefuO4eOq2 SIXxCaR+9yC0a/dxXG1vUBIR6dqjNdKWXnYMvPrncjGwXrtRT2cLNMlars2/zU5kFjv5gxBPd UcK3UItOPKKTM1f1zGM1zhdJbXwAQ17H9xL/y7sHVasjX92/Tr7o7NyXkVt+Btqs4ZhxlgCzA y9H/0XILh6W0Gm0nmimdcPXLyupLyAGg7o8QjIFt7jfZ2C3EMVMq/WxxOB/tNHbMe81z2myOX UGpGiRLPYf8/qtBegtDHU4hBjAY617vnqzHme8SUbZlfgMsznwfT6aKhUZ72qpmO0zUYXC5zm xkTZiFlO8AaufUDwMTUfBnQn7f0FKob30mTfIRJi5527UFvIQ6BgirKwk1qDOwGnGfHO4v+py Kql3DlPQDWGELsq8BZZs4Gco0iKJewd9p1OGm6FwlPjf2I5LUq7dG+AUcDouCd72Acwr4A0qj 4LmZUilV3XuTLXtqlhGhjun48iYhU/6VvdQzAH2psKE/tUUTJUPbmpcuWgTnWCTdD5hzD5wQ8 zyIdb1Q+Nb/UNTAOR96g+55iS4pAVKoqt0/Dgp/6n8vmLqsSEVos4FxPTZjVgecrAQqBreTKj P3ILCf+XCnh7fKeZf7MS2BKsOIAtYUdRcrUOxUi4F6srxDPgCchQ0+amcQrdeVnfZS6fKPQls trunvoqPGNcHwww6T000VHxiii6jqIs4RXfjiUO3wkqfXbfdYA+r1Y2OQph5Mg+CrVzgaU99B s5odKUWj2jMBXLpmuMI5oOTB9Yk8WpzIzMtQ5CFWKucYTSl6VFA8JDzXw2FZ9G0vJvmdnQH+r h6IHGc/uZeQDSFIGgqPUlyy+T2x9E5j06l4mpWOsXnxRxWxy3eXjfZ6qH/Kj4f4m6jbjQF+Np 56pS2OzkGgIh1umxbHjr3PSnGpLylmzEPHzwE7etEYSTsd73fINT8CpQqjVcQrsF9d0DPIzRE eAx+qP2UJdkZVCmgxLZ4ys4BTr82ekcmhaH3+tibUQg2KnSPabUUv2jAW2wALeQmJW08ZJ0+a K7u2JYL6arABigBWa3uihjO9qiQ3oW0jzDwaSdQb7ZqWgKzO458TpOET096q+0dDNcUDm9khl K25O2yq9/Ojmuz5vfDUBeYf7tVAJv9SZdCyiW0mwjK8GH4/ZEnHg9rSDjCSjzLfRtV6RChhxh k+eHlslqFJKon0uutJtUhlSeHl5IrwHZD+kZMsWxqEqLdDm2rI5EsdInwWckKlz26irtQhpJH ZFswLyZtazkRgrwy5h4ypwzvuJTeuGk8FTqV0Vn62kqXbBDN2l9p4pRmBwH2ujkoWRhgrPreP yLNIPxeO0K20DI44KFR6Oxe54ZGrJ88yntqoCuXYB5dqv2fZydV8qF3Czfd90AUfFmq9zYQJg MKxNhBkjQ5JZpxZ/o7ZeW44dNfv4D6TGMq6+GK7uSCqNuTrEZTahv7LFTJXun0dFXT3vVfsAD rVCOTgHGqDhPsLMe8YyCpaSM3WeFy4gVrypJxCGVBvtTjCLK/WyAilXB5T9PuVNcdnGQRcDJR dZ3qa51CS7VznOXDzPSUjCZ6FAPdthPb+dtQYsrkdbf8DgScWhpX6ZAUectt2zctBcNHLWd0f 25Ep2F4q8nGMhowI9g1qpGWZhbomVaO6LEORRNlOhKjKt1tXtRZPfmnHfoJ44PGUuztyvaqWp aktwy9pNRme61+LMLB7F/+R5CLXb+LAKqtns4EXaJFzTCKQHF/bkndkkCZE2WZq4cOajBX5Fo ySvz2qfBSRyHYPA9G9Q8Vwvie+UjU5MtfSFecC15ica4QJhFjuqoZV0pJVrd6cd9SoARbFaF8 UewIJZd5RSDis2SewAISJz3fBPPBm8egewaqaaqX2wP41TZWPVPfo1i6DM4yseUOPPs6WNRao mUbsq60V5Y7FWVncwcivb+G3Z4gAsVtVvaO9xNaHPQbY5FNQwuMil5+IRQSk8jIM9zWDOcG6O Vfn/QPlcbX2YbUlajHMFch3jSMWNa+KMtv31qFvLL9HOPar+2jtfwI64ozmQsd2JYJbkMwWXl tXMFZ58NfnEyFqYdCogM5vUsBHCMOHwAO6QpTNcjdQXD2/2tC5thViSBfrlQxKqwhbusk+Vqh RamaD4yDgWsG5kvbw48zPi8l8U4eBk1d6piCyOIH8Fr3UnlJJ/hMxKtIpjUIZdey8e/ArdQd+ vr2+vVIA5EYiZQzAyIrqRvbanfWXYqBzOih6NjeeLPWyqZm0mCct1+rlqLUTNLN1fe9hp2Z4b Pqqmccpvkc40tbCajeyzaAx1TJMPklUwciYoOFGmHjs+APThWlhW6TjZ9Y3SttyotjlVSIhxK aYrxo5DM9UOCGj16tUmnFyXZzAwORCo6ym2q4bP+Xq7CTWpyaHKkRFIiYj8nIM6hj02lPBzum i4ho+z3mP4gecwSxv0PWrGzzwXz/GNQixSq3E1s3oV61q6Y0n515AdlLQuFb4LSrhobyhdo4Q O6AJ95QiCiJoIN7lY39D5Od0r2Ya3jt8Q0PjDnn19utFukVtYvhgR6iaPtydyKtpRQ3jY+PyR 4wgJH7IkVI2cjX1NUHix2NWNHiA2CCUTjm46D/YL4LV X-SPAM-LEVEL: Spam detection results: 1 DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust RCVD_IN_MSPIKE_H4 0.001 Very Good reputation (+4) RCVD_IN_MSPIKE_WL 0.001 Mailspike good senders SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record X-MailFrom: matthis@buechse.org X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation Message-ID-Hash: BZLFJSPP4DB7UQQ34VX5DCBHFCXM442U X-Message-ID-Hash: BZLFJSPP4DB7UQQ34VX5DCBHFCXM442U X-Mailman-Approved-At: Tue, 03 Nov 2026 13:28:36 +0100 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Hi all, I'd like to work on a small feature and wanted to check the approach = with you before diving into programming and sending patches. Problem ------- A VLAN-aware Linux bridge is a common way to use a Proxmox VE host as a = small switch: several physical NICs are enslaved to one bridge and each = port is either an access port for one VLAN or a trunk for a subset of = VLANs, optionally with one native (untagged) VLAN, e.g. for access = points or switches with an untagged management network. ifupdown2 = supports this per port: auto enp3s0 iface enp3s0 inet manual bridge-access 10 iface enp5s0 inet manual bridge-vids 10 40 50 60 iface enp1s0f1 inet manual bridge-pvid 10 bridge-vids 10 40 50 60 PVE already preserves these lines when saving the network config, but = they are neither shown nor editable via API/GUI. The port looks like an = untagged member of the bridge in the network view, which is misleading = when troubleshooting, and the only way to change it is editing = /etc/network/interfaces by hand. Related: #2764 (open, which also mentions bridge-access/bridge-vids on = ports in its description), #3128 (closed as duplicate of #2764), #3893 = (bridge-level bridge-vids, fixed in pve-manager 8.2.9). In #5802 it was = suggested to expose options that ifupdown2 already supports via the = existing parser/writer; this would follow the same idea. Proposal -------- - pve-common (INotify): parse/write `bridge-access`, `bridge-pvid` and = `bridge-vids` for eth/bond/vlan interfaces, reusing the = pve-vlan-id-or-range format added for #3893. - pve-manager (API2/Network): add optional parameters for these = interface types: - `bridge_access` (single VLAN ID) for an access port, - `bridge_port_pvid` (single VLAN ID, native/untagged VLAN) and = `bridge_port_vids` (list/ranges, tagged VLANs) for a trunk port. `bridge_access` is mutually exclusive with the other two. All of them = are accepted regardless of the current bridge membership, so a port can = be prepared before it is added to a bridge (the settings only take = effect once the interface is a port of a VLAN-aware bridge). - widget-toolkit (NetworkEdit): show the fields under "Advanced" (e.g. a = mode selector access/trunk), so the default dialog stays as simple as = today. If the interface is currently not a port of a VLAN-aware bridge, = show a hint that the setting has no effect until it is. - Network view: optionally a column/tooltip showing the port's access = VLAN, or native and allowed VLANs, marked as inactive where they = currently have no effect. - pve-docs: short example in the VLAN section. The bridge's own `bridge-pvid` (untagged VLAN of the bridge itself) is = likewise not exposed yet; it could be added to the bridge dialog next to = the existing bridge-vids field in the same series or later. Open questions -------------- 1. Is this something you'd accept in general, or would you rather see it = handled via SDN? 2. Any preference on parameter naming (`bridge_access`, = `bridge_port_pvid`, `bridge_port_vids`)? 3. Should the fields live on the port (eth/bond) dialog as proposed, or = on the bridge (as a per-port table)? 4. If a bridge's vlan-aware flag is disabled, or a port is removed from = the bridge, the port settings silently stop having an effect. Should the = API/GUI warn about that, keep the settings as they are, or remove them? 5. Should the bridge-level `bridge-pvid` be part of this series or a = separate one? I'm happy to send a patch series for common, widget-toolkit, manager and = docs once the direction is clear. Best, Matthis Eicher=