Skip to main content

Multiple VLANs on a Synology NAS

Synology, like other SOHO/SMB NAS vendors, touts VLAN functionality with their current DSM 4.1 software. However, the web interface just lets you specify one VLAN tag to use over each eth interface (or bond interface).

Manual approach

In the busybox environment that you can ssh into as root (after enabling ssh through the webinterface), there's all the tools you need to use multiple VLANs over one link (eth or bond), however:
First you insert the 802.1q module into the Linux kernel:
 /sbin/lsmod | /bin/grep -q 8021q || /sbin/insmod /lib/modules/8021q.ko
Then you add each VLAN you need to every interface (bond0 in this example)
 /sbin/vconfig add bond0 4
And finally you can configure IP addresses on every interface.vlan combination (bond0.4 in this example)
 /sbin/ifconfig bond0.4 broadcast netmask
The same type of script would work on a QNAP NAS too, by the way. They offer 8021q.ko and vconfig in their commandline environment as well.
Packets from the bond0 interface leave the device untagged, packets from the bond0.4 interface leave with a tag specifying VLAN 4.
Be aware that these settings only last until the next reboot.

Synology approach (future?)

Synology has its own set of utilities that are used by the webinterface to manage devices. The network interface settings are managed by /usr/syno/sbin/synonet. This utility sets up bonded interfaces, IP addresses, and VLAN entries. However, the utility has the same limitations as the web interface (for unknown reasons): creating a VLAN unconfigures the untagged interface you're working on, and you can't add a second VLAN on the same interface.
It would be nice if synonet could get multi-VLAN support, as all the necessary options seem to be there already. Feature request, Synology?


bert said…
An additional note: if you want to present iSCSI targets on manually created VLAN interfaces, you have to add a line to the corresponding /etc/sysconfig/network-scripts/ifcfg-IF.VLAN file (e.g. ifcfg-bond0.15) specifying the IP address IPADDR= . If you don't do this, nothing will be listening on port 3260 on this interface
Nick Welsh said…
I have tried this but get "/lib/modules/8021q.ko: Permission denied" although I am log in as admin. the other question I have will this code be resident after reboot or upgrade?
Brandon Neill said…
Admin doesn't have privileges from the command line. Log in as root with the same password as admin.
Unknown said…
This comment has been removed by the author.
Aaron Von Gauss said…
I definitely can't take credit for it as I found it on another blog, but another way is to configure the bonding interface with two or more ports, assign a default VLAN ID such as 1 for 802.1q tagging. Once this is done, SSH in to the box and make clones of the /etc/sysconfig/network-scripts/ifcfg-bond0.1 file for each additional VLAN you want to support (changing the filename, DEVICE and VLAN_ID as appropriate). By assigning a 802.1Q tag to the default channel, DSM will automatically manage kernel modules.

Using this method, DSM should bring up the VLAN interfaces automatically and even (at least in 4.3) exposes them via the GUI albeit with limitations. You can manage the IP addresses / MTU from the GUI for the additional VLAN interfaces as well and it will survive a reboot. I haven't tested with all other services, but I can say basic file sharing, NFS and iSCSI will also automatically start up on the cloned VLAN interfaces.
Bert de Bruijn said…
This article has another approach (and links back here):

Popular posts from this blog

Volkswagen UHV bluetooth touch adapter & its problems

My Volkswagen car has the "universal cellphone preparation" UHV built-in. This is the main part of a car kit, but requires an additional adapter for connecting to a cellphone. At first, I was using an adapter for my good old Nokia 6310, even after I changed to the Nokia E71. Connecting was easy: pair the phone with the "VW UHV" bluetooth entity, and done. This has the phone connected to the car kit at all times, so even non-call-related functions use the car audio system (e.g. voice recognition).
But progress will have its way, no matter what happens. So in comes the "bluetooth touch adapter". Instead of a phone-specific adapter, this is a small touchscreen device that slots into the UHV dashboard mount. Connecting a phone is very different now:
the Bluetooth Touch Adapter connects to the "VW UHV" device via bluetooth
the phone connects to "Touch Adapter" device, also via bluetoothThe device doesn't allow step 2 if step 1 didn't s…

How to solve "user locked out due to failed logins" in vSphere vMA

In vSphere 6, if the vi-admin account get locked because of too many failed logins, and you don't have the root password of the appliance, you can reset the account(s) using these steps:

reboot the vMAfrom GRUB, "e"dit the entry"a"ppend init=/bin/bash"b"oot# pam_tally2 --user=vi-admin --reset# passwd vi-admin # Optional. Only if you want to change the password for vi-admin.# exitreset the vMAlog in with vi-admin These steps can be repeated for root or any other account that gets locked out.

If you do have root or vi-admin access, "sudo pam_tally2 --user=mylockeduser --reset" would do it, no reboot required.

Link aggregation and VLANs on QNAP with firmware 3.4.0

The new QNAP firmware (3.4.0) supports 802.1q VLAN tagging, but you can't create multiple interfaces in different VLANs on the same physical interface through the webinterface.In the case of link aggregation (LACP 802.3ad for example), that means only 1 VLAN and 1 IP address can be used. Fortunately, QNAP allows full access to the underlying Linux system. Adding a VLAN interface goes like this (the example uses VLAN 234)# /usr/local/bin/vconfig add bond0 234 # ifconfig bond0.234 broadcast netmask
of course, this change is not permanent, a reboot will not automatically start this interface. I'll blog about making it permanent later.