For the brave: If * you know what you are doing * you are sure you don't have colliding unicast MAC addresses on all (to be) attached VLANs * you have an upstream connection via GE0 or GE1 that does the VLAN encaps/decaps * all VLANs you want to pass to nodes are tagged then you can configure it eg. via Armbian with file based cloud-init for example. Just ensure you create the VLAN slave device via cloud-init net config and set the encap/decap config to tagged * you won't have traffik leaks between VLANs * you will have switching fully hardware offloaded, as it is a switch (and all MACs are uniq, prereq. see above)