Server unreachable from other VLANs. Help!

Hey guys, not aure of this is the right place or better somewhere like r/homenetworking or r/homeserver.

I am in the process of setting up an Omada network and am running into VLAN issues.

Right now have 2 VLANs. Vlan 1 is the management vlan and Vlan 10 is the home vlan. Vlan 1 contains my home server and I am trying to get devices on Vlan 10 to connect to the server. It runs things like jellyfin and my home automation stuff.

I have not set up any ACLs and so as I understand it with Omada all vlans should be able to talk to all other vlans.

From the server I can ping other devices on the 10 vlan, but only devices on the 1 vlan can ping the server or connect to its services.

The server is running Ubuntu 22.04 and all the services are running in docker behind traefik for TLS with let’s encrypt.

I don’t really understand why the server can ping things on the 10 vlan and get a response but the things on 10 can’t. And at this point I don’t even know where to go next.

Any ideas??? Pointers?

  • hereisjames@alien.topBEnglish
    11·
    10 months ago

    It’s probably ultimately to do with whether you’ve set the correct port profiles on the switch and whether you’ve set the right IP addresses.

    I started writing an explanation of VLANs, tags, trunk and client ports, and IP addresses but it quickly got long and I’m sure other people have done a much better job explaining elsewhere, so I suggest you do a bit of background reading or watching.

    But, very briefly - you configure switch ports through profiles. The profiles say which VLANs are sent through that port.

    If there is more than one VLAN being sent through a port the switch will send traffic tagged with the VLAN it belongs to, you need to configure the device connected to the port to understand those different VLAN tags, have more than one IP address, etc. These are usually called trunk or tagged ports on the switch. The switch expects to receive Ethernet traffic from the device already tagged with which VLAN it belongs to. If it receives a frame from the device without a VLAN tag, it will usually put it in the default VLAN, which is 1 on most switches.

    If the device is just on one VLAN, the switch port facing it needs to be told it is a client or untagged port on that VLAN. Then it will remove the VLAN tag before it sends traffic so your device only sees standard Ethernet frames and it doesn’t need to understand VLANs at all. When your device sends traffic, the switch will put the right VLAN tag on it before sending it onwards. If you don’t tell the switch which VLAN the port belongs to, it will usually assume 1. You need to make sure your device has an IP in the right range for the VLAN it’s in.

    • Hangman4358@alien.topOPBEnglish
      1·
      10 months ago

      Thank you so much. I just spent too much time looking at it yesterday. Fresh eyes and the gist of this got me there.

      Turned out to be multiple issues. The switch port the server is connected to was not a client port like you said. I just totally overlooked this. I has all my ports set to client ports for their specific device just not the server…

      And then it turns out I has the server configured to have a static IP with a subnet mask of /16 instead of /24. Fixed those two things and bam! works as expected.

  • toolology@alien.topBEnglish
    11·
    10 months ago

    Is this a windows server? The firewall maybe only be set to respond to pings (icmp echo request) from the local subnet. Its on the scope tab of the firewall rule.

    • Hangman4358@alien.topOPBEnglish
      11·
      10 months ago

      No, running Ubuntu server 22.04 on baremetal.

      The only thing affected appears to be the server. If I hook my laptop up to the 10 vlan I can still ping my desktop on the 1 vlan, and ping back.

      It is like the server is not responding to pings from other subnets.

      • ShadowAEnglish
        1·
        10 months ago

        Double check your subnet mask on the network interfaces.

        Use “tcpdump -i eth### icmp” on your server to see if it’s receiving the packets, and if it’s replying. If it’s not replying, check firewall rules.

      • darkcloud784@alien.topBEnglish
        11·
        10 months ago

        Check if ufw is enabled, if so allow icmp. If your on a different vlan you would have to have a router between you and the other vlan. Make sure you have the IP/subnet/gateway right on your server.