Isolate VMs with bridge VLANs
Three VMs share one hypervisor bridge. Use VLAN filtering so the two sales VMs talk to each other while the engineering VM is isolated. That's the everyday job of virtual networking.
Scenario
A KVM hypervisor runs three VMs, each on a tap interface plugged into one Linux bridge br0:
- tap1: sales VM
- tap2: sales VM
- tap3: engineering VM
Right now the bridge has no VLAN filtering, so all three VMs share one broadcast domain: engineering can see sales traffic. Fix it with bridge VLANs.
Your job
Edit bridges.conf so that:
- the two sales VMs (tap1, tap2) can reach each other, and
- the engineering VM (tap3) is isolated from sales.
The tools
Standard iproute2 / bridge commands:
ip link add br0 type bridge vlan_filtering 1 # bridge with VLAN filtering on
ip link set tap1 master br0 # attach a tap
bridge vlan add dev tap1 vid 10 pvid untagged # put the tap in an access VLAN
Put sales in VLAN 10 and engineering in VLAN 20.
What "done" looks like
All three taps attached, tap1 and tap2 in the same VLAN (connected), tap3 in a different VLAN (isolated from sales).
Teaches: bridge VLAN filtering: how virtual networks keep tenants and roles separated on shared hypervisor hardware.
What gets checked
Your solution is verified against each of these:
- All three VM taps are attached to the bridge
- The two sales VMs (tap1, tap2) share a broadcast domain
- The engineering VM (tap3) is isolated from sales by VLAN
Solve it in your browser
No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.
Solve in browser →Prefer your own lab?
- Build the fix locally. New to the tooling? See setting up your lab.
- Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
- Submit the repo link. We review it by hand, confirm it works, and issue your proof page.