Tagged and untagged on same port




I have been trying to connect a small server running vSphere to my router and letting the server use untagged traffic to access the management network and tagged (VLAN2) for the VM network. The MGMT network is the same as the LAN network ( and the VLAN2 is

I have looked at the diagram at: https://doc.turris.cz/doc/en/howto/vlan_settings_omnia to figure out how to set things up. I have created a new interface, set it to bridged, added eth0, eth2 and eth0.2 but cannot ping to one of the VMs. What is the way to make this work?

Thanks for the help.


Do you want your 2 VLANs to be bridged? Because as far as I understand that‘s what you did and this can‘t work because you can‘t just bridge two subnets with diffrent IP ranges.

I assume your VLAN2 should have it‘s own interface (eth0.2) that shouldn‘t be bridged with your LAN. It should have its own firewallzone. Communication between your subnets should be routed, so you need to allow forwarding in firewall settings as you want it.

Is your TO your router (default gateway) in both of your subnets? If not you also need to set static routes on the according gateways.

EDIT: Also in your switch config VLAN2 needs to be tagged on according LAN-Port and CPU. To test your config you can set VLAN2 untagged on another LAN-Port to connect another client to see if you get an ip, can ping etc.