How to remove 802.1Q header on "untagged" bridge egress

I found pages like this https://0x2142.com/whats-wrong-with-vlan-1 which seem to say VLAN 1 is “bad” because it’s commonly used so a hacker can try VLAN 1 first. Changing it to something else is simply security through obscurity. The real fix is to be careful which ports are allowed to be trunk ports.

I use untagged (hybrid VLANs) because I have many virtual machines, some on different VLANs. I don’t want to configure the host machine to be only on a VLAN, for a variety of reasons.

I use the same VLAN 1 as used by default on my Dell switch. So far, nobody here has said why VLAN 1 is “bad”, if you have a very good example please post that. But we are already very off topic here; using VLAN 1 is not the reason my packets have an 802.1Q header with VLAN ID 0.


I don’t know why @anav keeps trolling. Just stop posting to my thread.

That’s the dude from the Patrick Swayze movie “Road House”, cool movie

Did you not see the avatar, I do not even come close to resembling a troll, quite insulting to us induced ovulators ( for the layperson - calmidae family).
Perhaps you need to chill just a bit more,
A classic!!
https://www.youtube.com/watch?v=Pe2K5iT8lwE

PS. Take your vlan1 and put it where the sun don’t shine! In plain english, vlanX (where x does not =0,2-9) not good!!

Seriously, if it works for you, then thats great! It has given me problems in the past and we all strive for happy outcomes..

I couldn’t use ether3 but I did add a different port ether5. Here is the config:


/interface bridge
add admin-mac=52:54:00:17:DE:AD auto-mac=no igmp-snooping=yes name=bridge1-lan vlan-filtering=yes
/interface bridge port
add bridge=bridge1-lan interface=ether3-plato
add bridge=bridge1-lan frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=ether4 pvid=1000
add bridge=bridge1-lan interface=ether2-shop
add bridge=bridge1-lan interface=ether1-switch
add bridge=bridge1-lan frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=ether-vm-lan
add bridge=bridge1-lan frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=ether5 pvid=1000
/interface bridge vlan
add bridge=bridge1-lan comment=lan tagged=ether1-switch,ether2-shop untagged=ether4 vlan-ids=1
add bridge=bridge1-lan comment=wanonly tagged=bridge1-lan,ether1-switch,ether2-shop vlan-ids=2
add bridge=bridge1-lan comment=lanonly tagged=bridge1-lan,ether1-switch,ether2-shop vlan-ids=3
add bridge=bridge1-lan comment=privvpn tagged=bridge1-lan,ether3-plato vlan-ids=44
add bridge=bridge1-lan untagged=ether4,ether5 vlan-ids=1000

And here is the result, the same 802.1Q header with VLAN ID 0. This is tcpdump from a PC on the ether4 side, pinging to a PC on ether5:

14:46:17.976459 00:23:54:8c:62:93 (oui Unknown) > 74:d4:35:e7:f3:98 (oui Unknown), ethertype IPv4 (0x0800), length 98: archimedes > 10.10.10.1: ICMP echo request, id 2, seq 175, length 64
14:46:17.977432 74:d4:35:e7:f3:98 (oui Unknown) > 00:23:54:8c:62:93 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 0, p 0, ethertype IPv4, 10.10.10.1 > archimedes: ICMP echo reply, id 2, seq 175, length 64

Nothing in that bit of code looks odd to me. I tried to break VLAN 1 and couldn’t. I was consistently able to ping from one computer to another. The only other random place I can think to look is at your switch settings in ROS to be sure the VLAN header setting isn’t set to Add if Missing and to be sure VLAN 0 isn’t assigned to any ports in the switch VLAN settings assuming you’re using a device with a switch chip that supports VLAN table. Beyond that, I’m out of ideas.

Its well known in the network world to avoid tagging with VLAN 1. Different vendors treat this in different ways and causes all sorts of hassles so most just avoid it.

Usually a tagged frame with vlan.id 0 is used for QoS - this allows the priority to come through without actually assigning a vlan. I see you are using tcpdump on a host - though a I am a big proponent of packet capture, I suggest that you take it to the next level - remove the end host behavior (is this a VM, perhaps?) and use a tap and grab the traffic off the link, not via the end host nor the transmitting device. Best to get a third party view of the problem at this point.