Hi,

I need some help with setting up my unraid properly. I have to NICs, one dedicated for administration and one for docker containers and VMs with a few vlans (i.e. the services provided). Unfortunately there seems to be some mess in my config and I cannot access containers on a certain bridged interface.

What I want to achieve: Connect to the Unraid GUI via eth0 on 192.168.42.100 only. Connect to docker containers via eth1 on vlans 1 (192.168.42.0/24) and 10 (192.168.20.0/24) and connect to VMs also via eth1 on vlans 10 and 20 (192.168.20.0/24).

I can reach the backrest container on 192.168.42.10, but nothing on the other networks like br1.10

Here is the config of eth0:

This is eth1:

And this is the docker config:

And this is the container I am trying to reach, but so far without any success :-(

And here an overview of all containers:

Any idea of what I did wrong here?

Thanks,

Klayman

your fighting ip routes as eth0 and eth1 are on the same subnet.

ip route

i need the output of ip a and ip route.

you have to edit the ip route for the vlan and/or attach additional ip route rules...

I'm still testing stuff on unraid. in debain:

#!/usr/bin/env bash
set -euo pipefail
PARENT="br1"
SHIM="mac0"
SHIM_IP="192.168.2.10/24"
GW="192.168.2.1"
TABLE="100"
# Create shim if missing
if ! ip link show "$SHIM" &>/dev/null; then
  ip link add "$SHIM" link "$PARENT" type macvlan mode bridge
fi
# Bring it up with IP (idempotent)
ip addr show dev "$SHIM" | grep -q "${SHIM_IP%%/*}" || ip addr add "$SHIM_IP" dev "$SHIM"
ip link set "$SHIM" up
# Relax rp_filter for asymmetric return paths
sysctl -w net.ipv4.conf.${SHIM}.rp_filter=2 >/dev/null
# Policy routing: traffic FROM the shim IP uses table 100 via mac0
# Clear old rules for this table/ip first (idempotent)
ip rule | awk -v t="table ${TABLE}" '$0 ~ t {print $1}' | xargs -r -n1 ip rule del pref
ip rule add from ${SHIM_IP%%/*}/32 table ${TABLE} pref 10010
ip rule add to 192.168.2.42/32 table ${TABLE} pref 10011  # optional fast-path to the container
# Routes in table 100 (replace existing)
ip route flush table ${TABLE}
ip route add 192.168.2.0/24 dev ${SHIM} table ${TABLE}
ip route add default via ${GW} dev ${SHIM} table ${TABLE}
exit 0

#adatiional scripting
# 1) Loose reverse-path filtering so asymmetric paths aren’t dropped
sysctl -w net.ipv4.conf.mac0.rp_filter=2 #macvlan shim bridge
sysctl -w net.ipv4.conf.br0.rp_filter=2 #Main interface eth0
sysctl -w net.ipv4.conf.all.rp_filter=0

# 2) Policy routing: traffic FROM 192.168.2.10 uses table 100 via mac0
ip rule add from 192.168.2.10/32 table 100 pref 10010 2>/dev/null || true
ip route replace 192.168.2.0/24 dev mac0 table 100
ip route replace default via 192.168.2.1 dev mac0 table 100

# (optional but nice) also route traffic TO the container via mac0
ip rule add to 192.168.2.42/32 table 100 pref 10011 2>/dev/null || true

you may need to setup adational ip routes and ip rules for vlan traffic.

but essential your vlan due to iproute is tying to use eth0 as eth0 and eth1 share a subnet

Edited September 28, 2025Sep 28 by bmartino1
data and info - spelling

Your symptoms line up with two classic gotchas on Unraid:

1. you have two L3 interfaces in the same /24 (192.168.42.0/24), so Linux will pick the “wrong” egress sometimes (policy routing needed if you insist on this), and

2. host ↔ macvlan/ipvlan access quirks when you try to reach containers/VMs living on VLAN bridges from the host.

Below is a clean, repeatable layout that fixes both and matches your goal: eth0 only for Unraid GUI, eth1 for services on VLANs 1,10,20.

(Potental fix - action order)

1. Give br0/eth0 the only IP in 192.168.42.0/24 (192.168.42.100/24 gw .1).

2. Put br1.1, br1.10, br1.20 → IPv4 None (no gateways).

3. On the switch, make eth1 a trunk with VLANs 1/10/20 to your router.

4. Use ipvlan docker networks bound to br1.1 / br1.10 / br1.20 with the proper subnets/gateways.

5. (Optional) If the host must reach those VLANs directly, use the small shim + ip rule script above.

That’ll give you: GUI only on 192.168.42.100 (eth0), and containers/VMs cleanly reachable on eth1 VLANs without iproute fights.

Switch / Router (make sure first)

• The switch port for eth1 is a trunk/tagged port carrying VLAN 1,10,20 (VLAN 1 can be native/untagged or tagged; just be consistent with Unraid).

• Your router has SVIs / gateways:

  • VLAN 1 → 192.168.42.1/24

  • VLAN 10 → 192.168.20.1/24

  • (and VLAN 20 → whatever you plan, e.g. 192.168.30.1/24)

Unraid – Network Settings (stable “one L3 per subnet” design)

Goal: Only br0 (eth0) holds an IP in 192.168.42.0/24 for management. The service VLANs live on br1 VLANs with no IPs on the host—so the kernel won’t fight you on routes.

• eth0

  • IPv4: Static 192.168.42.100/24

  • Gateway: 192.168.42.1

  • Bridging: Yes (br0)

  • VLANs on br0: No

• eth1

  • IPv4: None

  • Bridging: Yes (this creates br1)

  • VLANs on br1: Yes

    • br1.1 (VLAN 1) → IPv4 None (do not give the host an IP here)

    • br1.10 (VLAN 10) → IPv4 None

    • br1.20 (VLAN 20) → IPv4 None

  • No gateway on br1 or any br1.x

This makes Unraid itself reachable only at 192.168.42.100 via eth0/br0, and it keeps the kernel from creating competing routes for the same /24 on br1.1.

*If you’ve previously given br1.1 an IP inside 192.168.42.0/24, remove it and reboot networking (or the server) after applying the above.

Docker – use IPvlan and pin each VLAN to its parent

Using ipvlan avoids the macvlan host-call-trace mess and is simple for L3 separation.

In Settings ▸ Docker:

• Docker custom network type: ipvlan

• Parent interface for custom networks: choose none here (we’ll create per-VLAN networks manually), or set one then override with -o parent below.

# VLAN 1 (containers in 192.168.42.0/24 on br1.1)
docker network create -d ipvlan \
  --subnet=192.168.42.0/24 --gateway=192.168.42.1 \
  -o parent=br1.1 pub42

# VLAN 10 (containers in 192.168.20.0/24 on br1.10)
docker network create -d ipvlan \
  --subnet=192.168.20.0/24 --gateway=192.168.20.1 \
  -o parent=br1.10 pub20

# VLAN 20 (example)
docker network create -d ipvlan \
  --subnet=192.168.30.0/24 --gateway=192.168.30.1 \
  -o parent=br1.20 pub30

*Attach each container to the correct network (pub42, pub20, pub30).
From other LAN clients, you’ll reach them normally through your router (SVIs).

VMs – attach to br1 VLANs

For VMs that should live on VLAN 10 and 20:

• Add a virtio NIC and select br1.10 or br1.20 as the bridge.

• Configure the VM’s guest IP/gateway inside the VM (e.g., 192.168.20.x with gw 192.168.20.1).

Host container/VM access (optional, from Unraid shell itself)

Because the host (192.168.42.100 on br0) is not on br1.1 anymore, the kernel won’t “hairpin” traffic for you. If you want Unraid itself to reach containers on those VLANs:

Option A (recommended): Let routing do it—your router already has the VLAN SVIs. The host will hit 192.168.42.1 and the router forwards to the container subnets. No extra config needed.

Option B (direct shim on the VLAN): Add a tiny “shim” IP on each VLAN using a macvlan/ipvlan sub-iface plus policy routing so replies go back out the same VLAN. Here’s a single-VLAN example for VLAN 10; adapt for others as needed:

*Recommend / minor ip rule route fixes

#!/usr/bin/env bash
set -euo pipefail

PARENT="br1.10"          # the VLAN bridge
SHIM="mac10"             # shim iface name
SHIM_IP="192.168.20.10/24" # a free IP in VLAN 10 just for the host
GW="192.168.20.1"
TABLE="110"

# Create shim if missing
ip link show "$SHIM" &>/dev/null || ip link add "$SHIM" link "$PARENT" type macvlan mode bridge
ip addr show dev "$SHIM" | grep -q "${SHIM_IP%%/*}" || ip addr add "$SHIM_IP" dev "$SHIM"
ip link set "$SHIM" up

# policy routing: packets FROM the shim IP use table 110 via the shim
ip rule del pref 10110 2>/dev/null || true
ip rule add from ${SHIM_IP%%/*}/32 table ${TABLE} pref 10110

ip route flush table ${TABLE}
ip route add 192.168.20.0/24 dev ${SHIM} table ${TABLE}
ip route add default via ${GW} dev ${SHIM} table ${TABLE}

# rp_filter relaxed to allow asymmetric return if needed
sysctl -w net.ipv4.conf.${SHIM}.rp_filter=2 >/dev/null

Now the host can curl 192.168.20.x using source 192.168.20.10 and replies will return the same path.

If you only need host access occasionally, skip this shim and just test from another machine on the VLAN—it keeps the host simpler.

Explanation:Why you could reach 192.168.42.10 but not br1.10

• With br1.1 (VLAN 1) in the same /24 as br0 you created an ambiguous ARP/routing situation; sometimes it works, sometimes it hairpins the wrong bridge.

• For br1.10, if the bridge exists but the host has no L3 route (no IP) and the switch port isn’t trunking VLAN 10, you’ll see exactly “containers unreachable.” The above layout fixes both: L2 present (trunk), L3 via router, and no duplicate subnets on the host.

Sanity - Quick health checklist

Run these from the Unraid shell after applying:

# The host should have exactly ONE default route via br0/eth0
ip -4 route

# You should NOT see a host route for 192.168.42.0/24 via br1.1
# (only via br0). VLAN 10/20 shouldn't appear unless you added shims.

# Docker networks bound to right parents:
docker network ls
docker network inspect pub42 | grep Parent
docker network inspect pub20 | grep Parent

# A container on VLAN 10 should ARP its gateway on br1.10:
# (replace veth name as needed)
bridge link | grep br1.10

If still stuck, grab and share plese:

ip -4 a

ip -4 route

ip rule show

docker network inspect pub42 pub20

Thank you very much, I will try this tomorrow right away and let you know if it worked. Please allow one more question: Is it also possible to bind Samba to vlan 10 on eth1 only?

Thanks,

Klayman

2 hours ago, Klayman said:

Thank you very much, I will try this tomorrow right away and let you know if it worked. Please allow one more question: Is it also possible to bind Samba to vlan 10 on eth1 only?

Thanks,

Klayman

its is only if we manual edit the smb config to use the interface and vlan.

it took a while as this is just a hobby, but now it works. Thanks a lot. The samba part will be the next I'll try to figure out :-)

38 minutes ago, Klayman said:

it took a while as this is just a hobby, but now it works. Thanks a lot. The samba part will be the next I'll try to figure out :-)

The issue I have with unraid samba and vlans netowrking is the inablity to edit samba global settings.
testparm is your friends

in my samba example with testparm:
interfaces = unriad static ip for br0/24 127.0.0.1 tailsaclae ip


so you can try to add adational address by editing the smb extra area and adding

[global]

interfaces = 192.168.42.x/24

otherwise you will need to edit samba manualy and replace it.
https://forums.unraid.net/topic/178033-bmartino1-user-scripts/#findComment-1478661