Skip to main content

Q-in-Q

Q-in-Q is a technology that allows you to create multiple isolated segments within a single VLAN by adding an additional tag to the Ethernet packet header.

Q-in-Q can only be enabled for a private network. Q-in-Q configuration in a private network is required:

  • for the Direct Connect service to work when a trunk port is configured on the provider side;

  • to configure a trunk port in VMware ESXi on a dedicated server with VMware;

  • to use different VLAN segments on a dedicated server where virtual servers are deployed. In this case, the dedicated server is connected to a private network with the virtual server using a global router. Tagged traffic from different VLAN segments terminates on the global router and is then routed to the virtual server.

How it works

All Selectel switch ports to which dedicated servers are connected are configured in Access mode.

By default, the source server sends an Ethernet packet without tags. When the packet reaches a Selectel switch port, a tag with the VLAN ID of the server's private network is added to it. This tag is used to transmit the packet within the Selectel network. Before the packet is delivered to the destination server, the VLAN ID tag is removed at the switch, and the server receives the original Ethernet packet without tags.

When Q-in-Q is enabled, you can transmit your own Q-in-Q tag. In this case, the Q-in-Q tag is added to the Ethernet packet header at the output of the source server and is transmitted to the destination server unchanged.

An example of transmitting an Ethernet packet between two dedicated servers:

Configure Q-in-Q

  1. Enable Q-in-Q on the switch port.

  2. Select a private subnet.

  3. Configure network interfaces on the server.

1. Enable Q-in-Q on the switch port

When Q-in-Q is enabled, there may be a short-term private network downtime for servers on the selected VLAN.

  1. Create a ticket requesting to enable Q-in-Q. In the ticket, specify:

    • VLAN IDs, which can be viewed in the control panel: in the top menu, click Products → Dedicated Servers → Network → the VLAN tab → the VLAN column;

    • pools containing VLANs, which can be viewed in the control panel: in the top menu, click Products → Dedicated Servers → Network → the VLAN tab → the Pool column.

  2. Wait for a response from a Selectel technician confirming that Q-in-Q has been enabled.

2. Select a private subnet

Select an unallocated subnet whose IP addresses will be used to configure network connectivity. For more information, see the Standard private IP address ranges subsection.

3. Configure network interfaces on the server

  1. Connect to the server via SSH or via the KVM console.

  2. Open the netplan configuration file with the vi text editor:

    vi /etc/netplan/01-netcfg.yaml

  3. Add Q-in-Q settings for the private network interface:

    ...
        vlans:
          <eth_name>.<id>:
                id: <id>
                link: <eth_name>
                mtu: 1400
                addresses:
                    - [<ip_address>/<mask>]

    Specify:

    • <eth_name> — private network interface name;
    • <id> — Q-in-Q tag; you can specify a number from 2 to 4094;
    • <ip_address> — IP address from the new private subnet;
    • <mask> — subnet mask.
    Example of the netplan utility configuration file
    network:
        version: 2
        renderer: networkd
        ethernets:
            eth0:
                addresses: [203.0.113.0/24]
                gateway4: 203.0.113.1
                nameservers:
                    addresses: [198.51.100.1,198.51.101.1]
            eth1:
                addresses: [192.168.0.2/24]
    ...
        vlans:
            eth1.40:
                id: 40
                link: eth1
                mtu: 1400
                addresses:
                    - [10.0.0.15/24]

  4. Press ESC.

  5. Exit the vi text editor and save your changes:

    :wq

  6. Apply the configuration:

    netplan apply

  7. Optional: reboot the server.