VM on VLAN tag 9 can’t reach gateway but host can

[Kratus]

Hi everyone,


I’m running Proxmox VE 8.3.0 on a host called alpha.
The host sits on vmbr0 (vlan‑aware yes → physical NIC ens1f0np0).
I have a Debian VM (ID 2000) whose virtual NIC is attached to vmbr0 with VLAN tag 9 and configured as 191.7.184.13/28 with gateway 191.7.184.9.


What works:

- The Proxmox host itself can ping 191.7.184.9 without any issue.

What doesn’t:


- The VM can’t reach the gateway (or anything else).
ip neigh on the guest shows the gateway in incomplete state.

Checks already performed


- bridge ‑d vlan confirms the tap device (tap2000i0) is tagged as VLAN 9.
- tcpdump ‑i vmbr0 vlan 9 and tcpdump ‑i ens1f0np0 vlan 9 both show the guest’s ARP requests (“Who‑has 191.7.184.9?”) leaving the host with tag 9.
- No ARP reply ever returns.
- Creating a vmbr0.9 sub‑interface (with or without an IP) made no difference, so I removed it and stayed with vmbr0 only.
- The physical switch port that connects Proxmox is a trunk allowing VLAN 9.

So the frame clearly leaves Proxmox, VLAN tag intact, but the gateway never answers. At this point I suspect the problem is external (gateway or switch mis‑handling VLAN 9), yet I’d like to hear if I’m missing anything on the Proxmox side before I escalate to the network team.


Thanks in advance for any insight!

 

[weehooey-bh]

If the traffic leaves the Proxmox VE node tagged correctly, then the issue is with the network gear after the PVE host. Have you checked the switch config?

 

[shanreich]

Is this instance hosted on hetzner by chance?

 

[Kratus]

If the traffic leaves the Proxmox VE node tagged correctly, then the issue is with the network gear after the PVE host. Have you checked the switch config?

I'm currently working to verify that possibility, and at first glance, the switch configuration seems fine. However, I haven’t seen the VM’s MAC address appear on the switch’s MAC table, which makes me suspect the return traffic is being dropped or filtered before it reaches the guest.

 

[Kratus]

Is this instance hosted on hetzner by chance?

No hetzner, this is currently internal a test environment where we are evaluating a possible migration from vSphere to Proxmox. We're still gaining experience with the platform, and at this stage, we’re trying to understand the full network flow — especially how traffic leaves the VM, passes through the Proxmox host, and reaches the core switch connected to it.


From what I've tested so far, everything appears to be correctly set up. The Proxmox host (node alpha) is able to reach the gateway at 191.7.184.9 through the core switch, so the upstream path seems to be working fine.


However, the VM still can't reach the gateway or receive any return traffic. If there's any advanced diagnostic or specific Proxmox feature/tool that could help trace or capture this more deeply, I’d really appreciate any pointers.


Thanks again for the support — we’re trying to learn and get things right....

 

[weehooey-bh]

I'm currently working to verify that possibility, and at first glance, the switch configuration seems fine. However, I haven’t seen the VM’s MAC address appear on the switch’s MAC table, which makes me suspect the return traffic is being dropped or filtered before it reaches the guest.

Please provide the contents of your /etc/network/interfaces file.

Have you enabled the PVE firewall?

 

[Kratus]

Por favor, forneça o conteúdo do seu /etc/network/interfaces arquivo.

Você já jogou o firewall PVE?

Firewall PVE is disable.

 

[weehooey-bh]

Please provide the contents of your /etc/network/interfaces file.

Sorry, I should have been clearer. Your PVE host's /etc/network/interfaces file.

 

[Kratus]

Sorry, I should have been clearer. Your PVE host's /etc/network/interfaces file.

No problem, weehooey-bh — here it is

 

[weehooey-bh]

@Kratus thanks. I have some questions.

What are the following interfaces connected to?

• eno4
• ens1f1np1
• ens1f0np0

Specifically, are they connected to the same switch? If so, what port number is each interface connected to on that switch? If not the same switch, what are the names of the switches, and what are the port numbers on those switches? I am interested to know how the packets flow from ens1f1np1 and ens1f0np0 to other parts of your network.

Something to note: when alpha pings 191.7.184.9 and 191.7.184.13 the traffic will travel vmbr1 > ens1f1np1 > destination because vmbr1 has a gateway defined. I am not sure if that is what you are expecting, is it?