tunneling L2 tagged traffic over IP

Nikos Vassiliadis nvass at gmx.com
Mon Apr 27 13:57:03 UTC 2015

On 04/27/15 11:33, Victor Sudakov wrote:
> Victor Sudakov wrote:
>> Nikos Vassiliadis wrote:
>>>> Could you advise a solution for tunneling L2 (Ethernet) traffic over IP?
>>>> There is a solution in bridge(4) using the EtherIP protocol, but it
>>>> works with untagged frames only. I need to tunnel 802.1q tagged frames
>>>> as well.
>>>> Any ideas?
>>> You can do this with netgraph. Check this post:
>>> http://lists.freebsd.org/pipermail/freebsd-net/2005-October/008861.html
>> It's a modification of the /usr/share/examples/netgraph/ether.bridge
>> script. How do you know that it would pass 802.1q tagged frames? It
>> references a "fxp0" interface which passes untagged traffic unless a
>> vlan(4) interface is configured on top thereof.
> The script does not work. It prints error messages like
> + ngctl mkpeer bnet0: ksocket link1 inet/dgram/udp
> + ngctl msg ng0:inet bind inet/
> ngctl: send msg: No such file or directory
> + ngctl msg ng0:inet connect inet/
> ngctl: send msg: No such file or directory
> + expr 1 + 1
> and does not generate any traffic. Perhaps it needs some debugging. I
> am still looking for a solution, thanks in advance to all who has
> anything to say.
> In the meanwhile, I have tried bridging ethernet NICs and tap(4), and
> connected two tap(4) devices with net/vtun. It works, but again, only
> for untagged frames.


I just checked and remembered that there is a sysctl
that controls forwarding of non-IP traffic

> sysctl net.link.bridge.pfil_onlyip
> net.link.bridge.pfil_onlyip: 1

That means that only IP is allowed to be forwarded by the bridge.
Change this to 0 and it will be hopefully ok.


More information about the freebsd-questions mailing list