Connect Your Raspberry Pi To Multiple Networks

For one of my experiments I had to connect my RPi to two networks at the same time. How do you do that? After all my RPi only has one Ethernet connector. One way of doing that is by adding a USB Ethernet adapter to create a second network. Case closed.

Wait a minute, both networks live as separate VLANs on my managed switch. Isn't it possible to connect to both VLANs at the same time? The switch can do that easily, the question is: "Can the Raspberry Pi do that too?".
HP switch
The answer is a big YES. And while we're at it, there is virtually no limit to the maximum number of VLANs your RPi can connect to over its single Ethernet port. (Not entirely true, you can have "only" 4095 different VLANs on one Switch.)

Tagging Versus Untagging

Allow me to explain how VLAN trunking on a IEEE 802.1q compatible network works. You can skip this chapter if you already know or don't want to know. After all, you don't have to know how it works, as long as your Ethernet Switch and your Raspberry Pi know how to.
First of all you'll need to have managed Ethernet Switch for this to work. None of the standard consumer Switches I know are managed and won't be able to do the tricks we're after on this page.

Normally all Ethernet ports on a managed Switch are Untagged. This means that all packets sent and received by the Switch are unchanged. In this configuration each Ethernet port will carry the signals from one single VLAN only. A broadcast packet sent on e.g. VLAN 2 will only output from the Ethernet ports which are untagged to VLAN 2.
This way all VLANs are isolated from one another. If you want a computer to connect to multiple VLAN at a same time, you'll need multiple network cards. Each card is connected to a separate Ethernet port on the Switch, belonging to one of the VLANs you're interested in.
The software in the managed Ethernet Switch will prevent a port to be untagged to more than one VLAN at the same time. If you untag a port on VLAN 2, it will automatically disconnect from the VLAN it was untagged to previously.

Tagged ports on the other hand modify packets sent from it and expect received packets to be modified too. Four bytes are added to the beginning of each packet sent or received. These four extra bytes are the tag (or label), carrying the VLAN number the packet belongs to.
Tagged packets are no longer compatible with normal network connections, because they don't know what to do with these 4 extra bytes. Things get even worse if the network connection can't cope with packets containing more than 1500 bytes (maximum MTU for an Ethernet package). Tagged packets can contain 1504 bytes, as long as the network card allows it. Most modern network cards do.
This way data from multiple VLANs can be transported through one single Ethernet port on your managed Switch. It's up to the other side to de-multiplex the data to the individual VLANs again.

One of the advantage of VLAN tagging is that less physical Ethernet ports and data cables are needed to connect a device to multiple VLANs simultaneously. Another advantage is that the network configuration is very flexible. You don't have to add physical network cards to your computer. The only thing you'll have to do is change one configuration file to add or delete as many virtual network adapters as you like.
The disadvantage is that all VLANs will have to share the bandwidth of one single network interface.

VLAN Tagging On Your Switch

Most modern managed Ethernet switches can handle VLAN trunking. All you need to do on the Switch side is enable tagging of the selected port to all the VLANs you want to connect to your RPi. How to do that differs from Switch to Switch. On my HP switch it's only a matter of ticking some boxes in the VLANs - Participation / Tagging menu. There you select a T for each VLAN you want to connect to the selected Ethernet port. And don't forget to click Apply for each VLAN.
VLAN tagging

Normally an output port of the Switch is Untagged. This means that none of the packets sent or received through this port are modified by the Switch. This also implies that the packets can belong to only one VLAN. Untagging a particular output port to a different VLAN will disable the port on the VLAN it previously belonged to.

If you set an output port of the Switch to Tagged to VLAN X, all packets belonging to VLAN X will be transmitted or received through the select port as well, all packets will carry the VLAN number. You'll have to tag the same Ethernet port to more than one VLAN, otherwise it will not make much sense to tag a port. You can even leave one VLAN untagged to that port.
In mixed mode you can have one Untagged VLAN connected to a port and one or more Tagged VLANs connected to the same port. In this mixed mode a normal computer will only be able to communicate with the untagged VLAN. All tagged packets will be ignored by a physicial network adapter. And a physical network adapter will never send out tagged packets, only virtual network VLAN adapters can do that. A computer can only connect to the Tagged VLANs if it is set up properly using IEEE 802.1q virtual VLAN network adapters.
Tagging a port implies that the connected computer (or other network device) has to be IEEE 802.1q compliant. Otherwise it won't understand the modified packets. Normal computers won't be able to connect to such a Switch port, without appropriate settings. I'll cover the RPi settings to make it IEEE 802.1q compliant next.

VLAN Trunking On Your Raspberry Pi

To make your RPi IEEE 802.1q compliant you'll have to install the vlan package and enable the 8021q kernel module. This can be done by the next four commands:

sudo apt-get install vlan
sudo su
echo 8021q >> /etc/modules
exit

After that you'll have to edit the file /etc/network/interfaces. An example of my file can be found below. You may need to adapt it to your own specific needs by adding or changing virtual network interfaces. I think the comments in the file explain what each block does. Adding networks is simply a matter of copy/paste an existing block and make the appropriate changes to the copied block.

# Defining the local loopback interface
# This part is standard
auto lo
iface lo inet loopback

# Mixed mode will allow my RPi to connect to a normal
# untagged network.
# Leave one VLAN on the managed switch  to be untagged
# to the output port connected to the RPi.

auto eth0
iface eth0 inet dhcp
# Connect all virtual VLAN trunks once the physical
# Ethernet comes up.
post-up ifup eth0.10
post-up ifup vlan20

# One method to create a virtual VLAN network adapter.
# The part after the dot defines the VLAN this network
# adapter will listen to (VLAN 10 in this case).
auto eth0.10
iface eth0.10 inet static
address 192.168.10.127
netmask 255.255.255.0

# An other method to create a virtual VLAN network adapter.
# The digits in the interface name are the VLAN number it
# will connect to.
auto eth0.20
iface vlan20 inet static
address 192.168.20.127
netmask 255.255.255.0
vlan_raw_device eth0

Finally you'll have to reboot your Raspberry Pi for the kernel module to become available. If you can't or don't want to reboot your computer you'll have to type the next two commands to make it all work.

sudo modprobe 8021q
sudo /etc/init.d/networking restart

Some Background Information

Mixed mode

In my example above I use mixed mode, which allows the physical network adapter eth0 to connect to any untagged VLAN on the switch. One advantage is that the RPi will also work on that VLAN if it is connected to another Ethernet port on my switch, which does not carry any tagged VLANs.
As a side effect it will give the physical interface the opportunity to come up. If you don't want your network setup to use the mixed mode you'll have to tie eth0 to an imaginary network. Simply setup a static IP address on eth0 to a non existing network segment. Don't use a DHCP setup, because in a non mixed mode the RPi will never receive a DHCP offer from a router because there is no Untagged traffic coming in. Therefore eth0 will fail to come up, preventing all virtual network adapters to come up after it.

Link local address for IPv6

I have noticed that all link local IPv6 addresses (the ones starting with fe80) of all virtual Ethernet adapters were equal to the address of the physical network adapter. If you come to think of it this is quite normal because the Link Local IPv6 address is derived from the network adapter's MAC address. And the MAC addresses of all virtual network adapters are equal to the MAC address of the physical network adapter.
At first I was tempted to change the MAC address of each virtual network adapter, which is easily done with the hwaddress option. However doing so has no positive effect, because of the way Link Local addresses are assigned. All Link Local IPv6 addresses of all the different network adapters in your computer, whether it be physical or virtual, share the same network segment. So even if the host address of each network adapter differs, they all still belong to the same network segment. This won't work on multiple network adapters, even if you do change the host address.
Zone IDs come to the rescue. If you want to use the Link Local IPv6 address to connect to a computer on VLAN 20, you'll have to add %vlan20 to the end of the IPv6 network address. Pinging a computer, connected to VLAN 20, on its Link Local IPv6 address is done like this:

ping6 fe80::1234:56ff:fe78:9abc%vlan20

Pinging a computer, connected to VLAN 10, on its Link Local IPv6 address is done like this:

ping6 fe80::abcd:12ff:fe34:5678%eth.10