Create a bridge

ip link add name br1 type bridge

# With brctl (deprecated)
brctl addbr br1

# Bring up the bridge interface
ip link set br1 up

Add interface to the bridge

ip link set dev wan master br1
ip link set dev lan1 master br1
ip link set dev lan4 master br1

# With brctl (deprecated)
brctl addif br1 lan1

# Bring up the interfaces
ip link set wan up
ip link set lan1 up
ip link set lan4 up

VLAN Filtering

Ingress: Traffic coming in to the bridge through an interface on the bridge

• PVID: Primary VLAN ID makes the specified VLAN ID assigned to the interface the primary one. Untagged ingress will be assigned to the specified VLAN ID. There can be multiple VLAN IDs assigned to the interface. This is not useful if only a single VLAN ID with egress set to untagged is assigned to the interface.

Egress: Traffic going out of the bridge through an interface on the bridge

• Egress untagged: Frames will leave the bridge through the specified interface as untagged. Untagged ingress will be assigned to the specified VLAN ID unless PVID is set to a different VLAN ID on the interface. Tagged ingress is discarded.
• Egress tagged: Frames will leave the bridge through the specified interface as tagged with the specified VLAN ID. Untagged ingress is discarded unless PVID is set to a VLAN ID on the interface. Tagged ingress is discarded if the VLAN ID on the tag doesn't match the VLAN ID(s) assigned to the interface.

# activate VLAN filtering
ip link set dev br1 type bridge vlan_filtering 1

# tag traffic on interfaces
bridge vlan add dev wan vid 2 pvid egress untagged
bridge vlan add dev lan4 vid 2

bridge vlan add dev lan1 vid 561
bridge vlan add dev lan4 vid 561

bridge vlan add dev lan1 vid 9-13 # add/delete VLANs through 9 to 13
bridge vlan delete dev lan1 vid 2

# remove the automatically added vid 1 from interfaces we don't want
bridge vlan delete dev wan vid 1
bridge vlan delete dev lan1 vid 1
bridge vlan delete dev lan4 vid 1

Associate the router to a VLAN

# properly associate the bridge interface to the VLANs
bridge vlan add dev br1 vid 1 self
bridge vlan add dev br1 vid 2 self

ip link add link br1 name vlan1 type vlan id 1
ip link add link br1 name vlan2 type vlan id 2

Add IPv4 address to the VLAN interface

ip address add 192.168.1.1/24 dev vlan1
ip address add 192.168.2.1/24 dev vlan2

# Bring up the interfaces
ip link set vlan1 up
ip link set vlan2 up