~/notes / container-vlan-tag
A container with no network: tagged twice
A new container got no DHCP and answered no pings. I had tagged its VLAN in Proxmox when the switch was already handling it.
$ cat summary
A new container on the server VLAN had no network at all: no ping, no DHCP. Its traffic was being tagged twice. The bridge was VLAN aware and I'd also set a VLAN tag on the container's network interface, but the switch port already handled that VLAN. Removing the tag in Proxmox fixed it.
$ cat root-cause
On a VLAN-aware bridge, a tag on a guest's interface means "send this guest's frames out tagged". The switch port the host sits on was already set up to put that traffic on the right VLAN. So the container's frames arrived carrying a tag the port wasn't expecting, and the switch dropped them. DHCP requests never reached anything, so the container never got an address.
$ cat fix
I cleared the VLAN tag field on the container's network interface in Proxmox and restarted it. It got an address right away.
$ cat lessons
- Tag in one place. Before setting a tag on a guest, check what the switch port already does with that traffic.
- No DHCP plus no ping points at layer 2. When a guest can't even get an address, look at the VLAN and the bridge before DNS or firewalls.