VLAN without address assigned

[mchaker]

Hello, I am using Talos OS 1.11.1 on my raspberry pi 4 cluster.
I am trying to make my "public IP" VLAN visible to/accessible by my Talos cluster, using a VLAN, without assigning an address to the VLAN interface.

I plan on using Cilium to offer VIPs/L2Advertisement IPs on the VLAN interface (I'm still not sure how that will work).

I have RFC1918 addresses on the default network interface (no VLAN tag). 172.25.1.0/24.

I have public IPs available on VLAN 3. 1.2.3.248/29

I have attempted to use the VLAN config block on my network interface. I don't think it's working.

Below will be my network: block of my machineconfig, then the dmesg output from talos saying "network unreachable".

Has anyone gotten VLANs to work on Talos without assigning an address to the VLAN interface?

network block of machineconfig:

    network:
        hostname: my-cluster-srv-1a
        interfaces:
            - interface: enabcm6e4ei0
              addresses:
                - 172.25.1.20/24
              routes:
                - network: 0.0.0.0/0
                  gateway: 172.25.1.1
              vlans:
                - vlanId: 3
                  routes:
                    - network: 1.2.3.249/32
                    - network: 0.0.0.0/0
                      gateway: 1.2.3.249
              mtu: 1500
              dhcp: false
        nameservers:
            - 172.25.1.1

my-cluster-srv-1a: user: warning: [2025-09-21T21:53:13.041182128Z]: [talos] controller failed {"component": "controller-runtime", "controller": "network.RouteSpecController", "error": "1 error occurred:\n\t* error adding route: netlink receive: file exists, message {Family:2 DstLength:0 SrcLength:0 Tos:0 Table:0 Protocol:4 Scope:0 Type:1 Flags:0 Attributes:{Dst:<nil> Src:<nil> Gateway:1.2.3.249 OutIface:22 Priority:1024 Table:254 Mark:0 Pref:<nil> Expires:<nil> Metrics:<nil> Multipath:[]}}\n\n"}

and when removing the extra 1.2.3.249/32 network from my vlans route list, i get this error:

my-cluster-srv-1a: user: warning: [2025-09-21T21:57:33.656367682Z]: [talos] controller failed {"component": "controller-runtime", "controller": "network.RouteSpecController", "error": "1 error occurred:\n\t* error adding route: netlink receive: network is unreachable, message {Family:2 DstLength:0 SrcLength:0 Tos:0 Table:0 Protocol:4 Scope:0 Type:1 Flags:0 Attributes:{Dst:<nil> Src:<nil> Gateway:1.2.3.249 OutIface:22 Priority:1024 Table:254 Mark:0 Pref:<nil> Expires:<nil> Metrics:<nil> Multipath:[]}}\n\n"}

Additionally, when adding an address to the VLAN interface, I get the following error... "file exists"?

    network:
        hostname: my-cluster-srv-1a
        interfaces:
            - interface: enabcm6e4ei0
              addresses:
                - 172.25.1.20/24
              routes:
                - network: 0.0.0.0/0
                  gateway: 172.25.1.1
              vlans:
                - vlanId: 3
                  addresses:
                    - "1.2.3.250/29"
                  routes:
                    - network: 0.0.0.0/0
                      gateway: 1.2.3.249
              mtu: 1500
              dhcp: false
        nameservers:
            - 172.25.1.1

error:

my-cluster-srv-1a: user: warning: [2025-09-21T22:04:49.265507791Z]: [talos] controller failed {"component": "controller-runtime", "controller": "network.RouteSpecController", "error": "1 error occurred:\n\t* error adding route: netlink receive: file exists, message {Family:2 DstLength:0 SrcLength:0 Tos:0 Table:0 Protocol:4 Scope:0 Type:1 Flags:0 Attributes:{Dst:<nil> Src:<nil> Gateway:1.2.3.249 OutIface:9 Priority:1024 Table:254 Mark:0 Pref:<nil> Expires:<nil> Metrics:<nil> Multipath:[]}}\n\n"}

And trying a different network config block, this time with everything on VLANs, yields a "file exists" error again.

    network:
        hostname: my-cluster-srv-1a
        interfaces:
            - interface: enabcm6e4ei0
              vlans:
                - addresses:
                    - 172.25.1.20/24
                  routes:
                    - network: 0.0.0.0/0
                      gateway: 172.25.1.1
                  vlanId: 5
                - vlanId: 3
                  addresses:
                    - 1.2.3.250/29
                  routes:
                    - network: 0.0.0.0/0
                      gateway: 1.2.3.249
              mtu: 1500
              dhcp: false
        nameservers:
            - 172.25.1.1

error

my-cluster-srv-1a: user: warning: [2025-09-22T13:37:33.334317456Z]: [talos] controller failed {"component": "controller-runtime", "controller": "network.RouteSpecController", "error": "1 error occurred:\n\t* error adding route: netlink receive: file exists, message {Family:2 DstLength:0 SrcLength:0 Tos:0 Table:0 Protocol:4 Scope:0 Type:1 Flags:0 Attributes:{Dst:<nil> Src:<nil> Gateway:1.2.3.249 OutIface:9 Priority:1024 Table:254 Mark:0 Pref:<nil> Expires:<nil> Metrics:<nil> Multipath:[]}}\n\n"}

[smira]

It's more of a networking configuration question rather than a Talos question.

1. You can't have two default gateways (at least with the same metric/priority).
2. If you set up a route behind a link, you need to tell the kernel how to reach that gateway.

[mchaker]

I see. Is it possible with Talos to set up a VLAN interface without an address or route? I want Cilium to manage the VLAN interface and L2 advertisements on the interface, while still having a 172.25.1.0/24 address on the physical non-VLAN interface.

[smira]

Don't set addresses and routes, and you will have a VLAN without it.

[mchaker]

That worked! Thank you so much.