VLAN trunk misconfiguration prevents IoT VLAN from accessing internet while management VLAN is fine

Environment

Home lab: Ubiquiti EdgeRouter X (firmware v2.0.9) as router with two configured VLANs (VLAN10 management, VLAN20 IoT). Access switch is an unmanaged TP-Link TL-SG108 with one physical uplink to router. IoT devices are ESP32 sensors obtaining DHCP from the router; router uses masquerade NAT for LAN-to-WAN.

Symptoms

IoT devices on VLAN20 obtain DHCP addresses in 192.168.20.0/24 but cannot reach the Internet. Devices on VLAN10 (192.168.10.0/24) have normal Internet access. A laptop configured with VLAN20 tags also shows no Internet but can ping the router's VLAN20 IP.

Observations

From an IoT device ping to gateway 192.168.20.1 succeeds; traceroute to 8.8.8.8 shows packets reach the router then stop. Router NAT table (iptables -t nat -L -n) shows MASQUERADE only for source 192.168.10.0/24, no rule for 192.168.20.0/24. Switch is unmanaged, so VLAN tagging on the uplink port is expected to be handled by router but physical uplink currently configured as untagged on VLAN10 only.

Already attempted

Rebooted router and switch. Tested laptop by configuring untagged access port physically on switch to an IoT device and assigning static IP on VLAN20 — gateway reachable but no WAN. Added a temporary iptables MASQUERADE rule for 192.168.20.0/24 on router which restored Internet for VLAN20 until router reboot. No changes made to firewall zones.

Question

What are the most likely configuration mistakes that cause one VLAN's traffic to be NATed/forwarded while another VLAN gets DHCP/gateway but no WAN, and what safe, reversible steps can I take to permanently restore connectivity for the IoT VLAN with minimal downtime?

Post timeline

COMMUNITY RESPONSES

Verified community troubleshooting

0 replies

No answers yet..

Showing 0 of 0 community responses

AI DIAGNOSTICS

Incident analysis

Updated 1w ago• Trouble ID

Most likely causes

Missing or mis-scoped NAT/masquerade rule for VLAN20 on the router (iptables/nftables configuration only covers VLAN10). 95%

Startup/config persistence problem: VLAN/NAT rules not saved to startup config and lost on reboot; temporary rule applied manually only until next reboot. 90%

Router firewall zone policy blocks forwarding from VLAN20 to WAN even though DHCP is available. 20%

Summary

Symptoms and the temporary fix indicate a NAT/firewall or trunking mismatch. The IoT VLAN has layer-3 connectivity to its gateway (router), but router lacks a persistent NAT rule for that subnet or the uplink frames from that VLAN are not being forwarded correctly. Because an iptables MASQUERADE rule restored access immediately, the router is currently dropping or not masquerading traffic from VLAN20 toward WAN. Additional contributing causes include firewall zone policies that only allow forwarding for VLAN10, incorrect trunk/untagged port configuration on the switch causing packets to be seen on the wrong interface, or a router startup script that doesn't recreate NAT for dynamically added VLANs.

Suggested Fixes

Diagnostic step 1

Do not change device firmware during troubleshooting. Backup current router configuration export before edits.

Diagnostic step 2

On the router, inspect persistent NAT rules: iptables -t nat -S (or equivalent nft list ruleset). If missing, add a persistent MASQUERADE rule for 192.168.20.0/24 and commit/save the configuration (e.g., add to config.boot on EdgeRouter).

Diagnostic step 3

Check firewall forwarding policies for the VLAN20 interface and ensure forwarding to the WAN zone is allowed; test by temporarily allowing wide-open forwarding then tighten once working.