1
Diagnostic step 1
Do not change device firmware during troubleshooting. Backup current router configuration export before edits.
FULL AI ANALYSIS
VLAN trunk misconfiguration prevents IoT VLAN from accessing internet while management VLAN is fine
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
Symptoms and the temporary fix indicate a NAT/firewall or trunking mismatch. The IoT VLAN has layer-3 connectivity to its gateway (router), but router lacks a persistent NAT rule for that subnet or the uplink frames from that VLAN are not being forwarded correctly. Because an iptables MASQUERADE rule restored access immediately, the router is currently dropping or not masquerading traffic from VLAN20 toward WAN. Additional contributing causes include firewall zone policies that only allow forwarding for VLAN10, incorrect trunk/untagged port configuration on the switch causing packets to be seen on the wrong interface, or a router startup script that doesn't recreate NAT for dynamically added VLANs.
Possible causes
Missing or mis-scoped NAT/masquerade rule for VLAN20 on the router (iptables/nftables configuration only covers VLAN10).
95%Startup/config persistence problem: VLAN/NAT rules not saved to startup config and lost on reboot; temporary rule applied manually only until next reboot.
90%Router firewall zone policy blocks forwarding from VLAN20 to WAN even though DHCP is available.
20%Switch uplink configured as untagged/native for VLAN10 only, so VLAN20 traffic is never forwarded correctly off the switch consistently.
15%Suggested fixes
2
Diagnostic step 2
On the router, inspect persistent NAT rules: iptables -t nat -S (or equivalent nft list ruleset). If missing, add a persistent MASQUERADE rule for 192.168.20.0/24 and commit/save the configuration (e.g., add to config.boot on EdgeRouter).
3
Diagnostic step 3
Check firewall forwarding policies for the VLAN20 interface and ensure forwarding to the WAN zone is allowed; test by temporarily allowing wide-open forwarding then tighten once working.
4
Diagnostic step 4
Verify switch uplink expects tagged frames for both VLANs. If using an unmanaged switch, move the IoT devices and the router to a dedicated access port or replace with a managed switch supporting 802.1Q trunks, or configure the router to use untagged ports consistently.
5
Diagnostic step 5
Reproduce the failure after a controlled reboot: reboot router to confirm rules persist. If NAT disappears on reboot, ensure the change is saved in the router's persistent config rather than applied only at runtime. Document the change so it can be rolled back easily if needed; keep a console connection available if you need to restore remote access after changes (avoid locking yourself out). If hardware/firmware limitations are suspected, escalate to vendor support for router/switch firmware guidance.