Beating my head against the wall for something that should just work.
Create new linuxBridge on second NIC (vmbr1) click vlan aware, add allowed vlan(s), give it an ip address. Can ping from from router.
assign this bridge to LXC, DHCP and vlan tag, cant ping. Assign w/DHCP, w/o vlan tag, cant...