Verify VLAN Isolation from a Linux Host

#!/usr/bin/env bash
# verify-vlan-isolation.sh — stand in a VLAN and prove the walls hold.
#
# Pings are read-only. The only thing this script ever creates is one
# optional virtual VLAN interface on your own machine (--vlan N), and it
# deletes it again on exit.
#
# Usage:
#   ./verify-vlan-isolation.sh            # test from this host's current network
#   ./verify-vlan-isolation.sh --vlan 20  # first join VLAN 20 (needs a trunk port + sudo)
set -u

# ==== MAKE THESE VALUES YOUR OWN ==========================================
PARENT_IF="eth0"                 # your wired interface (list yours: ip link)
INTERNET_TARGET="8.8.8.8"        # anything reliably reachable on the internet

# What SHOULD answer from where you're standing. NOTE: with the strict IoT
# firewall from the companion post (input REJECT), the IoT gateway will NOT
# answer pings from inside its own VLAN — leave this empty when standing
# there, or list hosts you know answer (e.g. a sibling device in the VLAN):
EXPECT_OK=()

# What SHOULD be unreachable from here (e.g. a trusted PC, the lab NAS):
EXPECT_BLOCKED=("192.168.1.50" "10.0.0.10")
# ==========================================================================

VLAN_ID=""
if [ "${1:-}" = "--vlan" ] && [ -n "${2:-}" ]; then
  VLAN_ID="$2"
fi

PASS=0
FAIL=0

VIF=""
cleanup() {
  if [ -n "$VIF" ]; then
    echo "Cleaning up: removing $VIF"
    command -v dhclient >/dev/null 2>&1 && sudo dhclient -r "$VIF" 2>/dev/null
    sudo ip link del "$VIF" 2>/dev/null
  fi
}
trap cleanup EXIT

if [ -n "$VLAN_ID" ]; then
  VIF="${PARENT_IF}.${VLAN_ID}"
  echo "Joining VLAN $VLAN_ID via $PARENT_IF (creates temporary interface $VIF)..."
  sudo ip link add link "$PARENT_IF" name "$VIF" type vlan id "$VLAN_ID" || exit 1
  sudo ip link set "$VIF" up
  if command -v dhclient >/dev/null 2>&1; then
    sudo timeout 20 dhclient -1 "$VIF"
  elif command -v dhcpcd >/dev/null 2>&1; then
    sudo timeout 20 dhcpcd -1 --noipv6 "$VIF"
  else
    echo "No DHCP client found — assign an address manually, e.g.:"
    echo "  sudo ip addr add 10.0.20.200/24 dev $VIF"
  fi
  ADDR=$(ip -4 -o addr show "$VIF" | awk '{print $4}')
  if [ -n "$ADDR" ]; then
    echo "PASS  got address $ADDR on VLAN $VLAN_ID (trunk + DHCP are wired correctly)"
  else
    echo "FAIL  no address on $VIF — is this port carrying VLAN $VLAN_ID tagged?"
    FAIL=$((FAIL+1))
  fi
fi

# When a VLAN interface exists, pin every probe to it so the test can't
# quietly route over your regular connection and prove nothing.
BIND=""
if [ -n "$VIF" ]; then BIND="-I $VIF"; fi

probe() {
  # probe <host> <should_answer: yes|no>
  if ping $BIND -c 2 -W 2 "$1" >/dev/null 2>&1; then RESULT="answered"; else RESULT="silent"; fi
  if { [ "$2" = "yes" ] && [ "$RESULT" = "answered" ]; } || \
     { [ "$2" = "no" ]  && [ "$RESULT" = "silent" ];   }; then
    echo "PASS  $1 $RESULT (expected)"
    PASS=$((PASS+1))
  else
    echo "FAIL  $1 $RESULT (expected the opposite)"
    FAIL=$((FAIL+1))
  fi
}

echo "--- reachability that SHOULD work ---"
probe "$INTERNET_TARGET" yes
for host in "${EXPECT_OK[@]}"; do probe "$host" yes; done

echo "--- isolation that SHOULD hold ---"
for host in "${EXPECT_BLOCKED[@]}"; do probe "$host" no; done

echo
echo "Summary: $PASS passed, $FAIL failed."
if [ "$FAIL" -eq 0 ]; then
  echo "The walls hold."
else
  echo "Segmentation is NOT doing what you think — check VLAN membership, PVIDs, and firewall forwardings."
  exit 1
fi