---
title: "Q-in-Q"
sidebar_label: "Q-in-Q"
description: "How Q-in-Q works and how to configure it"
sidebar_position: 7
---

import Formbricks from '@theme/MDXComponents/Formbricks';
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
import { TabItemLabel } from '@selectel/docux/components';
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical';

# Q-in-Q

Q-in-Q is a technology that allows you to create multiple isolated segments within a single VLAN by adding an additional tag to the Ethernet packet header.

Q-in-Q can only be enabled for a private network.Configuring Q-in-Q in a private network is necessary:

* for the Direct Connect service to work when a trunk port is configured on the provider side;

* to configure a trunk port in VMware ESXi on a dedicated server with VMware;

* to use different VLAN segments on a dedicated server where virtual servers are deployed.In this case, the dedicated server is combined into a private network with a virtual server using a [global router](/global-router/create-network/create-global-router-network.mdx).Tagged traffic from different VLAN segments is terminated on the global router and then routed to the virtual server.

## How it works

All Selectel switch ports to which dedicated servers are connected are configured in Access mode.

By default, the source server sends an Ethernet packet without tags.When the packet arrives at the Selectel switch port, a tag with the private network VLAN number of the server is added to it.This tag is used to transmit the packet within the Selectel network.Before delivering the packet to the destination server, the VLAN tag is removed at the switch, and the server receives the original Ethernet packet without tags.

When Q-in-Q is enabled, you can transmit your own Q-in-Q tag.In this case, the Q-in-Q tag is added to the Ethernet packet header at the exit from the source server and transmitted to the destination server unchanged.

An example of transmitting an Ethernet packet between two dedicated servers:

![](https://423.selcdn.ru/kb/dedic-q-in-q-ethernet-header-LANG-THEME.png)

## Configure Q-in-Q \{#configure-q-in-q}

1. [Enable Q-in-Q on the switch port](#enable-q-in-q-on-switch-port).

2. [Select a private subnet](#select-private-subnet).

3. [Configure network interfaces on the server](#configure-network-interfaces-on-server).

### 1. Enable Q-in-Q on the switch port \{#enable-q-in-q-on-switch-port}

When Q-in-Q is enabled, there may be a short-term private network downtime for servers on the selected VLAN.

1. [Create a ticket](https://my.selectel.ru/tickets/create/) with a request to enable Q-in-Q.In the ticket, specify:

   * VLAN numbers can be viewed in the [Control Panel](https://my.selectel.ru/servers/network/networks): from the top menu, click **Products** → **Dedicated Servers** → **Network** → **VLAN** tab → **VLAN** column;

   * pools that contain VLANs can be viewed in the [Control Panel](https://my.selectel.ru/servers/network/networks): from the top menu, click **Products** → **Dedicated Servers** → **Network** → **VLAN** tab → **Pool** column.

2. Wait for a response from a Selectel technician confirming that Q-in-Q has been enabled.

### 2. Select a private subnet \{#select-private-subnet}

Select an unused subnet, IP addresses from which will be used to configure network connectivity. More details in the [Standard private IP address ranges](/dedicated/networks/private-networks-and-subnets.mdx#standard-private-ip-ranges) subsection.

### 3. Configure network interfaces on the server \{#configure-network-interfaces-on-server}

<Tabs queryString="configure-network-interfaces-on-server">
  <TabItem value="ubuntu" default>
    <TabItemLabel>
      Ubuntu
    </TabItemLabel>

    1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or via the [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console).

    2. Open the `netplan` utility configuration file with the `vi` text editor:

       ```bash
       vi /etc/netplan/01-netcfg.yaml
       ```

    3. Add Q-in-Q settings for the private network interface:

       ```yaml
       ...
           vlans:
             <eth_name>.<id>:
                   id: <id>
                   link: <eth_name>
                   mtu: 1400
                   addresses:
                       - [<ip_address>/<mask>]
       ```

       Specify:

       * `<eth_name>` — the name of the private network interface;
       * `<id>` — the Q-in-Q tag; you can specify a number from 2 to 4094;
       * `<ip_address>` — an IP address from the new private subnet;
       * `<mask>` — the subnet mask.

       <details>
         <summary>Example of the netplan utility configuration file</summary>

         ```yaml
         network:
             version: 2
             renderer: networkd
             ethernets:
                 eth0:
                     addresses: [203.0.113.0/24]
                     gateway4: 203.0.113.1
                     nameservers:
                         addresses: [198.51.100.1,198.51.101.1]
                 eth1:
                     addresses: [192.168.0.2/24]
         ...
             vlans:
                 eth1.40:
                     id: 40
                     link: eth1
                     mtu: 1400
                     addresses:
                         - [10.0.0.15/24]
         ```
       </details>

    4. Press **ESC**.

    5. Exit the `vi` text editor with your changes saved:

       ```bash
       :wq
       ```

    6. Apply the configuration:

       ```bash
       netplan apply
       ```

    7. Optional: reboot the server.
  </TabItem>

  <TabItem value="debian">
    <TabItemLabel>
      Debian
    </TabItemLabel>

    1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or via the [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console).

    2. Open the network interfaces configuration file with the `vi` text editor:

       ```bash
       vi /etc/network/interfaces.d/50-cloud-init
       ```

    3. Add Q-in-Q settings for the private network interface:

       ```bash
       auto <eth_name>.<id>
       iface <eth_name>.<id> inet static
         address <ip_address>/<mask>
         vlan-raw-device <eth_name>.<id>
         mtu 1400
       ```

       Specify:

       * `<eth_name>` — the name of the private network interface;
       * `<id>` — the Q-in-Q tag; you can specify a number from 2 to 4094;
       * `<ip_address>` — an IP address from the new private subnet;
       * `<mask>` — the subnet mask.

       <details>
         <summary>Example of the network interfaces configuration file</summary>

         ```bash
         source /etc/network/interfaces.d/*
         auto lo
         iface lo inet loopback
         auto eth0
         iface eth0 inet static
           address 203.0.113.218
           netmask 255.255.255.0
           gateway 203.0.113.1
           dns-nameserver 198.51.100.1,198.51.101.1

         auto eth1
         iface eth1 inet static
           address 192.168.0.2/24

         auto eth1.40
         iface eth1.40 inet static
           address 10.0.0.15/24
           vlan-raw-device eth1.40
           mtu 1400
         ```
       </details>

    4. Press **ESC**.

    5. Exit the `vi` text editor with your changes saved:

       ```bash
       :wq
       ```

    6. Restart the network:

       ```bash
       service networking restart
       ```

    7. Optional: reboot the server.
  </TabItem>

  <TabItem value="centos">
    <TabItemLabel>
      CentOS
    </TabItemLabel>

    1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or via the [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console).

    2. Output information about the network interfaces:

       ```bash
       ip address
       ```

    3. Create or open the private network interface configuration file for Q-in-Q with the `vi` text editor:

       ```bash
       vi /etc/sysconfig/network-scripts/ifcfg-<eth_name>
       ```

       Specify `<eth_name>` — the name of the private network interface with Q-in-Q.

    4. Add the network interface settings:

       ```bash
       NAME="<q_in_q_eth_name>"
       ONBOOT=yes
       TYPE=Ethernet
       VLAN=yes
       DEVICE=<basic_eth_name>.<id>
       BOOTPROTO=static
       IPADDR=<ip_address>
       NETMASK=<mask>
       NM_CONTROLLED=no
       ```

       Specify:

       * `<q_in_q_eth_name>` — the name of the new network interface;
       * `<basic_eth_name>` — the physical interface of the private network to which the VLAN is attached;
       * `<id>` — the Q-in-Q tag; you can specify a number from 2 to 4094;
       * `<ip_address>` — an IP address from the new private subnet;
       * `<mask>` — the subnet mask.

       <details>
         <summary>Example of the configuration file for a network interface</summary>

         ```bash
         NAME="vlan40"
         ONBOOT=yes
         TYPE=Ethernet
         VLAN=yes
         DEVICE=eth1.40
         BOOTPROTO=static
         IPADDR=10.10.10.10
         NETMASK=255.255.255.0
         NM_CONTROLLED=no
         ```
       </details>

    5. Press **ESC**.

    6. Exit the `vi` text editor with your changes saved:

       ```bash
       :wq
       ```

    7. Restart the network:

       ```bash
       systemctl restart network
       ```

    8. Optional: reboot the server.
  </TabItem>

  <TabItem value="windows">
    <TabItemLabel>
      Windows
    </TabItemLabel>

    1. [Connect to the server via RDP](/dedicated/manage/connect-to-server.mdx#connect-via-rdp) or via the [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console).

    2. Launch **Server Manager Local**.

    3. Go to the **Local Server** section.

    4. Click **NIC Teaming**.

    5. In the **Teams** block, click **Task** → **New Team**.

    6. In the **Team name** field, enter the group name.

    7. Mark the network adapters that you want to add to the group.

    8. Click **OK**.

    9. In the **Adapter and Interfaces** block, click **Tasks** → **Add Interface**.

    10. In the **Interface name** field, enter the name of the new network interface.

    11. In the **Specific VLAN** field, enter the Q-in-Q tag; you can specify a number from 2 to 4094.

    12. Click **OK**.

    13. Open the **Network and Sharing Center**.

    14. Open the network interface of the new private network.

    15. Click **Properties**.

    16. Select **IPv4**.

    17. Click **Properties**.

    18. In the **IP-address** field, enter the private IP address of the server, for example `192.168.0.2`.

    19. In the **Subnet mask** field, enter the subnet mask.

    20. Click **OK**.
  </TabItem>
</Tabs>

<Formbricks />