proxmox/reports/VMID_7810_GATEWAY_LAYER23_DIAGNOSTIC.md

VMID 7810 Gateway Layer-2/Layer-3 Boundary Diagnostic

Date: 2026-01-05
Issue: Gateway 192.168.11.1 not reachable - suspected Layer-2/Layer-3 boundary problem

---

Problem Statement

Observation: VLAN 11 switching works (containers can reach each other), but VLAN 11's default gateway (192.168.11.1 on UDM Pro) is not reachable from VLAN 11 devices.

This points to a Layer-2/Layer-3 boundary issue between VLAN 11 devices and the UDM Pro's VLAN 11 SVI, not an "internet" or routing issue.

---

Diagnostic Tests Performed

Test 1: TCP Connectivity (Bypass ICMP)

Purpose: Determine if ICMP is blocked but TCP routing still works.

Commands:

nc -zv 192.168.11.1 53    # DNS
nc -zv 192.168.11.1 443   # HTTPS

Results: [See test output above]

---

Test 2: ARP/ARPing Gateway Discovery

Purpose: Check if gateway responds to ARP and verify MAC address.

Commands:

ip neigh flush all
arping -I eth0 192.168.11.1 -c 3
ip neigh show | grep 192.168.11.1

Results: [See test output above]

What to Look For:

• If arping shows responses from wrong MAC → duplicate gateway/ARP issue
• If no response → VLAN 11 not reaching UDM / port profile mismatch

---

Test 3: Proxmox Bridge VLAN Configuration

Purpose: Verify bridge VLAN awareness and tagging.

Commands:

cat /etc/network/interfaces
bridge vlan show

Results: [See test output above]

What to Check:

• bridge-vlan-aware yes on the bridge
• VLAN 11 present as expected
• No mismatch where VMs are tagged but switch port is access/native (or vice versa)

---

Test 4: HTTP Test to Gateway

Purpose: Additional TCP-based connectivity test.

Command:

curl -m 3 http://192.168.11.1

Results: [See test output above]

---

Test 5: Gateway MAC Address Check

Purpose: Verify ARP table entries for gateway.

Commands:

ip neigh show 192.168.11.1
ip neigh show | head -10

Results: [See test output above]

---

Test 6: Multi-Port TCP Test

Purpose: Test multiple TCP ports to see if any are reachable.

Command:

for port in 53 443 80 22; do
    timeout 2 bash -c "echo > /dev/tcp/192.168.11.1/$port"
done

Results: [See test output above]

---

Recommended Additional Checks (On UDM Pro)

Check 1: Verify UDM Pro VLAN 11 SVI Exists

SSH to UDM Pro and run:

ip addr | grep -E "192.168.11.1|vlan|br"
ip route | head

What to Look For:

• Interface that has 192.168.11.1/24 bound
• If not present: MGMT-LAN configured in controller but dataplane not applying it
• If present: Problem is likely tagging/port profile/ACL

---

Check 2: Verify VLAN Trunking to UDM Pro

In UniFi Controller:

1. Check switch port that uplinks from switch to UDM Pro
2. Check switch ports that uplink to Proxmox hosts
3. Verify all are trunked ("All" or profile with VLAN 11 tagged)

Common Issue: VLAN 11 exists on downstream switches but not properly trunked to UDM

---

Check 3: Check LAN LOCAL Firewall Rules

UniFi can block ping to gateway while still routing.

Verify:

• Check if LAN LOCAL rules block ICMP to gateway
• If ping fails but TCP 53/443 succeeds → LAN LOCAL blocking ICMP, routing may still work

---

Decision Tree

1. Does 192.168.11.1 exist on UDM interface?

   • No → Restart Network app / reboot UDM
   • Yes → Continue

2. Does nc -zv 192.168.11.1 53 work?

   • Yes → ICMP blocked; routing might still work; check DNS config
   • No → Continue

3. Does arping 192.168.11.1 return anything?

   • Response from wrong MAC → Duplicate gateway/ARP issue
   • No response → VLAN 11 not reaching UDM / port profile mismatch

4. Confirm uplink port profiles:

   • Switch↔UDM: trunking VLAN 11?
   • Switch↔Proxmox: trunking VLAN 11?

---

Most Likely Scenarios

Scenario A: UDM Not Binding VLAN 11 SVI

• Symptom: ip addr on UDM shows no 192.168.11.1
• Fix: Restart Network app or reboot UDM Pro

Scenario B: VLAN Tagging Path Issue

• Symptom: VLAN 11 works locally but not trunked to UDM
• Fix: Configure trunk ports properly in UniFi

Scenario C: LAN LOCAL Blocking Gateway

• Symptom: Ping fails but TCP works
• Fix: Adjust LAN LOCAL firewall rules

Scenario D: Gateway/ARP Conflict

• Symptom: ARP shows wrong MAC for gateway
• Fix: Find and remove duplicate 192.168.11.1 device

---

Next Steps

1. ✅ Run diagnostic tests above (in progress)
2. ⏳ Check UDM Pro VLAN 11 SVI (requires UDM SSH access)
3. ⏳ Verify VLAN trunking configuration in UniFi
4. ⏳ Review LAN LOCAL firewall rules
5. ⏳ Check for duplicate gateway IPs

---

Last Updated: 2026-01-05
Status: Diagnostic tests running