VLAN lab: VLANs and inter-VLAN routing on one Ubuntu VM in your browser

This lab gives each student a small office network to divide. Five machines are built inside the student’s one Ubuntu VM: a switch, a router, a host and a server that belong in one VLAN and a second host that belongs in another. At the start everything is plugged in and nothing is configured, so all of it is one network. The student makes two VLANs on the switch, joins them again through the router with one cable, and adds one rule that keeps one VLAN away from the server.

Nothing is installed on the student’s computer and no switch or router is needed: every machine is a network namespace, the switch is a Linux bridge with VLAN filtering, and the commands are the real ones, bridge vlan, ip link and nft.

What students learn

What a VLAN is and why a switch needs one: giving each switch port a VLAN and an untagged access port for a host, and carrying both VLANs tagged on a trunk port to the router, with the bridge vlan command; making an 802.1Q subinterface on the router for each VLAN with ip link, giving it the gateway address its hosts expect and turning on forwarding, which is inter-VLAN routing on a router on a stick; and writing one nft rule on the router that keeps one VLAN away from a server and leaves everything else working. They test it with ping, arping, traceroute and tcpdump, and write it all in two files so it comes back after a restart.

The topology

The switch sw has four ports. The host h10 and the server srv belong in VLAN 10, on 10.10.0.0/24, and the host h20 in VLAN 20, on 10.20.0.0/24. The router r1 has one cable, to the fourth port, and no address yet. At the start every port is in the default VLAN 1, so h20 can still reach srv straight across the switch, and nothing can reach a gateway. The student’s work goes in two files, one run in the switch and one in the router every time the lab starts. The addresses are in the README the lab leaves in the home folder, which says what to do and gives none of the answers.

Run it in your browser

VM labs are set as a lab task in a module, and the sample is on the lab’s page. The machine is small: one CPU, 1 GB of memory and 10 GB of disk.

  1. Add the lab. In a module you teach, add a task and choose the Ubuntu VM lab card. The page shows a short description of the machine instead of a compose file.
  2. Start from the sample. The page offers ready-made labs to start from. Choose VLANs and inter-VLAN routing. Using a sample replaces the text, and Undo brings yours back.
  3. Publish and start your own copy. Publish, then Start. The lab’s own setup script installs iproute2, nftables and a few small network tools from Ubuntu’s archive, and writes the vlanlab command, two empty configuration files and the README, the first time the VM starts, in a few seconds.
  4. Open the terminal. Open its terminal and read README.md in the home folder: it says what to build and gives none of the answers.

A basic lesson on this lab

VLAN Basics is a small lesson worked in this lab, which is an Ubuntu VM: each step is explained and has a Run button that types its command into the machine’s terminal and shows what it printed. A student meets the machines and sees every switch port in VLAN 1, asks h20 for srv with arping and gets an answer straight across the switch, pings the other network and gets nothing back, and finds that the router has no address yet.

The lesson looks around and leaves the lab’s own task, building the VLANs, to the student, so it hands out no answers. It is deliberately small: it shows a teacher what a lesson worked in a lab is, and the lab does the rest. Copy it into a module of your own to change it.

How it is marked

The lab has a check. It runs on a copy of the saved machine after a fresh start, loads the student’s two files the way the start does, and then tests what really happens between the machines: hosts in one VLAN answer each other directly and hosts in different VLANs do not, the router has an 802.1Q subinterface and the gateway address for each VLAN and forwards, h10 and h20 reach each other through the router, and h20 reaches srv by no port and no protocol while h10 still can. A rule that shuts VLAN 20 off from everything does not pass, nor does a rule put on the server, address translation, VLAN filtering switched off, or commands typed by hand and never saved in the files. The first line of what the check printed says why.

  1. Hand it out. Assign the lab like any task, with a due date if you want one. Each student gets a VM of their own, kept between sessions.
  2. Run the check. On a student’s row in the class list, press Run the check. It starts a copy of their saved machine that is not saved back, runs the lab’s check script as root and shows whether it passed, what it printed and when. The student is not told the result.
  3. Mark it. Read the first line of what the check printed: it says what is not right, such as a host that still reaches another VLAN straight through the switch or a ping that did not go through the router. Send the work back with a reason if it needs more.

The definition on GitHub

The file is the whole lab definition, the same text the platform runs: size, setup script, topology tool, README and check. Copy it and change the addresses, or add a VLAN, to make a longer lab.

Questions people ask

Does the lab need a managed switch, a router or a licence?
No. The switch is a Linux bridge with VLAN filtering and the router is Linux forwarding packets, both in Ubuntu’s own kernel. The tools are installed from Ubuntu’s archive when the student’s VM starts, and nothing of them is distributed by us.
Can a student reach the real internet from the lab?
No. The VM reaches Ubuntu’s archive, PyPI, npm and GitHub and nothing else, and the network between the five machines is virtual and inside the VM. The machines are network namespaces rather than separate computers.
What does a student build in the VLAN lab?
Two VLANs on the switch, one with an untagged access port for each host and a tagged trunk to the router, then an 802.1Q subinterface for each VLAN on the router, which is inter-VLAN routing on a router on a stick. Last, one nft rule on the router keeps VLAN 20 away from the server.