# Bridge VLAN Filtering Mode

## Overview

The advanced netmode now supports **bridge VLAN filtering**, a modern approach to VLAN configuration that uses the kernel's bridge VLAN filtering feature instead of creating separate VLAN devices.

### Benefits

- **Better Performance**: No need to create multiple VLAN devices
- **Cleaner Configuration**: Single bridge with VLAN filtering instead of multiple VLAN interfaces
- **Hardware Offloading**: Better support for hardware VLAN acceleration
- **Simplified Management**: All VLANs configured in one place

## Syntax

Use the `brvlan:` prefix instead of `bridge:` to enable bridge VLAN filtering:

| Traditional Mode | Bridge VLAN Filtering Mode |
|------------------|---------------------------|
| `bridge:tagged:100` | `brvlan:tagged:100` |
| `bridge:wan-tagged:100` | `brvlan:wan-tagged:100` |
| N/A | `brvlan:mixed:100` |

## Interface Types

### `brvlan:tagged:VID`

All ports are tagged with the specified VLAN ID.

**Example**:
```bash
uci set netmode.global.mode='advanced'
uci set netmode.@supported_args[12].value='brvlan:tagged:1499;ALL'
uci commit netmode && service netmode restart
```

**Resulting Configuration**:
```
config interface 'internet'
    option device 'br-internet.1499'
    option proto 'dhcp'

config device br_internet
    option name 'br-internet'
    option type 'bridge'
    option vlan_filtering '1'
    list ports 'ae_wan'
    list ports 'eth0'
    list ports 'eth1'

config bridge-vlan brvlan_1499_internet
    option device 'br-internet'
    option vlan '1499'
    list ports 'ae_wan:t'
    list ports 'eth0:t'
    list ports 'eth1:t'
```

---

### `brvlan:wan-tagged:VID`

WAN port is tagged, LAN ports are untagged.

**Example**:
```bash
uci set netmode.global.mode='advanced'
uci set netmode.@supported_args[12].value='brvlan:wan-tagged:1510-n;LAN1-LAN2-WAN'
uci commit netmode && service netmode restart
```

**Resulting Configuration**:
```
config interface 'iptv'
    option device 'br-iptv.1510'
    option proto 'none'

config device br_iptv
    option name 'br-iptv'
    option type 'bridge'
    option vlan_filtering '1'
    list ports 'ae_wan'
    list ports 'eth0'
    list ports 'eth1'

config bridge-vlan brvlan_1510_iptv
    option device 'br-iptv'
    option vlan '1510'
    list ports 'ae_wan:t'
    list ports 'eth0:u'
    list ports 'eth1:u'
```

---

### `brvlan:mixed:VID` or `brvlan:mixed:VID:TAGGED_PORTS`

Custom tagged/untagged configuration with flexible port-specific tagging.

**Syntax**:
- `brvlan:mixed:VID` - Default behavior: WAN tagged, LAN untagged
- `brvlan:mixed:VID:TAGGED_PORTS` - Specify which ports are tagged (e.g., `LAN1-WAN`)

**Example 1: Default (WAN Tagged)**:
```bash
uci set netmode.global.mode='advanced'
uci set netmode.@supported_args[12].value='brvlan:mixed:100;LAN1-LAN2-WAN'
uci commit netmode && service netmode restart
```

**Result**: WAN tagged, LAN1 and LAN2 untagged

**Example 2: Custom Tagging (LAN1 and WAN Tagged)**:
```bash
uci set netmode.global.mode='advanced'
uci set netmode.@supported_args[12].value='brvlan:mixed:200:LAN1-WAN;LAN1-LAN2-LAN3-WAN'
uci commit netmode && service netmode restart
```

**Resulting Configuration**:
```
config bridge-vlan brvlan_200_corporate
    option device 'br-corporate'
    option vlan '200'
    list ports 'eth0:t'      # LAN1 tagged
    list ports 'eth1:u'      # LAN2 untagged
    list ports 'eth2:u'      # LAN3 untagged
    list ports 'ae_wan:t'    # WAN tagged
```

**See [BRVLAN_MIXED_MODE_EXAMPLES.md](BRVLAN_MIXED_MODE_EXAMPLES.md) for comprehensive examples.**

---

## Comparison: Traditional vs Bridge VLAN Filtering

### Traditional VLAN Device Approach (`bridge:tagged:100`)

Creates separate VLAN devices for each port:

```
config device eth0_100
    option type '8021q'
    option vid '100'
    option ifname 'eth0'
    option name 'eth0.100'

config device wan_100
    option type '8021q'
    option vid '100'
    option ifname 'ae_wan'
    option name 'ae_wan.100'

config device br_internet
    option type 'bridge'
    list ports 'eth0.100'
    list ports 'ae_wan.100'
```

### Bridge VLAN Filtering Approach (`brvlan:tagged:100`)

Single bridge with VLAN filtering:

```
config device br_internet
    option type 'bridge'
    option vlan_filtering '1'
    list ports 'eth0'
    list ports 'ae_wan'

config bridge-vlan brvlan_100_internet
    option device 'br-internet'
    option vlan '100'
    list ports 'eth0:t'
    list ports 'ae_wan:t'
```

---

## Use Cases

### ISP Internet Service (VLAN 1499, WAN Tagged)

```bash
uci set netmode.global.mode='advanced'
uci set netmode.@supported_args[12].value='brvlan:wan-tagged:1499;LAN1-LAN2-WAN'
uci commit netmode && service netmode restart
```

### IPTV Service (VLAN 1510, WAN Tagged, No DHCP)

```bash
uci set netmode.global.mode='advanced'
uci set netmode.@supported_args[12].value='brvlan:wan-tagged:1510-n;LAN3-LAN4-WAN'
uci commit netmode && service netmode restart
```

### Multiple Services (Internet + IPTV)

```bash
uci set netmode.global.mode='advanced'
uci set netmode.@supported_args[12].value='brvlan:wan-tagged:1499;LAN1-LAN2-WAN,brvlan:wan-tagged:1510-n;LAN3-LAN4-WAN'
uci commit netmode && service netmode restart
```

### Corporate Network (All Ports Tagged)

```bash
uci set netmode.global.mode='advanced'
uci set netmode.@supported_args[12].value='brvlan:tagged:100;ALL'
uci commit netmode && service netmode restart
```

---

## Modifiers

Bridge VLAN filtering modes support the same modifiers as traditional bridge modes:

| Modifier | Effect | Example |
|----------|--------|---------|
| `-n` | Set proto=none (no DHCP client) | `brvlan:tagged:100-n` |
| `-d` | Create but mark as disabled | `brvlan:wan-tagged:200-d` |

---

## Verification

### Check Bridge VLAN Configuration

```bash
# View bridge device
uci show network | grep "vlan_filtering"

# View bridge-vlan sections
uci show network | grep "bridge-vlan"

# View interface status
ip addr show

# View bridge VLAN table
bridge vlan show
```

### Example Output

```bash
root@router:~# bridge vlan show
port              vlan-id
ae_wan            1499 Tagged
eth0              1499 Untagged
eth1              1499 Untagged
br-internet       1499
```

---

## Limitations

1. **No QinQ Support**: Bridge VLAN filtering does not currently support 802.1ad (QinQ) double tagging
2. **Single VLAN per Interface**: Each bridge-vlan section defines one VLAN
3. **Kernel Support Required**: Requires kernel with bridge VLAN filtering support

---

## Migration from Traditional Bridge

### Before (Traditional VLAN Devices)

```bash
uci set netmode.@supported_args[12].value='bridge:wan-tagged:100;ALL'
```

### After (Bridge VLAN Filtering)

```bash
uci set netmode.@supported_args[12].value='brvlan:wan-tagged:100;ALL'
```

Simply change the prefix from `bridge:` to `brvlan:`.

---

## Troubleshooting

### Check if VLAN Filtering is Enabled

```bash
cat /sys/class/net/br-internet/bridge/vlan_filtering
# Should output: 1
```

### View Bridge VLAN Table

```bash
bridge vlan show dev br-internet
```

### Check Kernel Support

```bash
# Check if bridge module supports vlan_filtering
cat /sys/module/bridge/parameters/vlan_filtering
```

### Enable Debug Logging

```bash
# Monitor netmode logs
logread -f | grep netmode-advanced
```

---

**Version**: 1.0
**Last Updated**: 2025-12-12
**Feature Status**: Production Ready
