Skip to main content

Q-in-Q

Last update:

Q-in-Q is a technology that allows you to create multiple isolated segments within a single VLAN by adding an additional tag to the Ethernet packet header.

Q-in-Q can only be enabled for a private network.Configuring Q-in-Q in a private network is necessary:

  • for the Direct Connect service to work when a trunk port is configured on the provider side;

  • to configure a trunk port in VMware ESXi on a dedicated server with VMware;

  • to use different VLAN segments on a dedicated server where virtual servers are deployed.In this case, the dedicated server is combined into a private network with a virtual server using a global router.Tagged traffic from different VLAN segments is terminated on the global router and then routed to the virtual server.

How it works

All Selectel switch ports to which dedicated servers are connected are configured in Access mode.

By default, the source server sends an Ethernet packet without tags.When the packet arrives at the Selectel switch port, a tag with the private network VLAN number of the server is added to it.This tag is used to transmit the packet within the Selectel network.Before delivering the packet to the destination server, the VLAN tag is removed at the switch, and the server receives the original Ethernet packet without tags.

When Q-in-Q is enabled, you can transmit your own Q-in-Q tag.In this case, the Q-in-Q tag is added to the Ethernet packet header at the exit from the source server and transmitted to the destination server unchanged.

An example of transmitting an Ethernet packet between two dedicated servers:

Configure Q-in-Q

  1. Enable Q-in-Q on the switch port.

  2. Select a private subnet.

  3. Configure network interfaces on the server.

1. Enable Q-in-Q on the switch port

When Q-in-Q is enabled, there may be a short-term private network downtime for servers on the selected VLAN.

  1. Create a ticket with a request to enable Q-in-Q.In the ticket, specify:

    • VLAN numbers can be viewed in the Control Panel: from the top menu, click Products → Dedicated Servers → Network → VLAN tab → VLAN column;

    • pools that contain VLANs can be viewed in the Control Panel: from the top menu, click Products → Dedicated Servers → Network → VLAN tab → Pool column.

  2. Wait for a response from a Selectel technician confirming that Q-in-Q has been enabled.

2. Select a private subnet

Select an unused subnet, IP addresses from which will be used to configure network connectivity. More details in the Standard private IP address ranges subsection.

3. Configure network interfaces on the server

  1. Connect to the server via SSH or via the KVM console.

  2. Open the netplan utility configuration file with the vi text editor:

    vi /etc/netplan/01-netcfg.yaml

  3. Add Q-in-Q settings for the private network interface:

    ...
        vlans:
          <eth_name>.<id>:
                id: <id>
                link: <eth_name>
                mtu: 1400
                addresses:
                    - [<ip_address>/<mask>]

    Specify:

    • <eth_name> — the name of the private network interface;
    • <id> — the Q-in-Q tag; you can specify a number from 2 to 4094;
    • <ip_address> — an IP address from the new private subnet;
    • <mask> — the subnet mask.
    Example of the netplan utility configuration file
    network:
        version: 2
        renderer: networkd
        ethernets:
            eth0:
                addresses: [203.0.113.0/24]
                gateway4: 203.0.113.1
                nameservers:
                    addresses: [198.51.100.1,198.51.101.1]
            eth1:
                addresses: [192.168.0.2/24]
    ...
        vlans:
            eth1.40:
                id: 40
                link: eth1
                mtu: 1400
                addresses:
                    - [10.0.0.15/24]

  4. Press ESC.

  5. Exit the vi text editor with your changes saved:

    :wq

  6. Apply the configuration:

    netplan apply

  7. Optional: reboot the server.