Hello Community,

I want to achieve the following.

My goal:

• NIC 1 / eth0 = WebGUI and system traffic, untagged

• NIC 2 / eth1 = VMs, tagged VLAN 4, subnet 192.168.4.1

• NIC 3 / eth2 = Containers, tagged VLAN 8, subnet 192.168.8.1

Config:

eth0: no bound, no bridge, no vlan, automatic IPv4

eth1: no bound, bridged, vlan 4, IP v4 and v6 allowed on the vlan, Assignment = None

eth2: no bound, bridged, vlan 8, IP v4 allowed on the vlan, Assignment = None

My VM uses br.1.4 for network, receives an IP and is reachable.

I have a little struggle with docker.

I tried multiple things:

Scenario 1:

• using the br.2.8 on Docker settings

• using custom docker network with ipvlan and parent br.2.8

• Containers doenst get a lease from my DHCP-Server and are not reachable

Scenario 2:

• using the eth2.8 on Docker settings

• using custom docker network with ipvlan and parent eth2.8

• Containers doenst get a lease from my DHCP-Server and are not reachable

Scenario 3 RETURNING TO MY OLD CONFIG:

• originally my eth2.8 had an DHCP Lease via Network Settings (192.168.8.10)

• using the br2.8 on Docker Settings

• using custom docker network ("docker network create")

• Containers use the DHCP Leasee from above 192.168.8.10 and are reachable

• i can access the containers BUT my VM (HomeAssistant) can't integrate them despite being pingable

• the BIG problem with this configuration: unraid send their webgui response via eth2.8, some packets are blocked by OPNSense (state violation rule) and the WEbGUi is extremly slow and needs constant reloads.

How do I do it right?

Thank you :)

Why do people always try to make it complicated???

Throw away all that stuff and go with one, fast, NIC.

There is no benefit from splitting the traffic apart, it only makes things more complicated and subject to fail.

Go out, get a 100G card and thats all you will ever need.

(ok, 40,25 or even 10G would do the same normally too already)

I know.. I know...but I want to split my traffic.
The different VLANS are for different things and I want to segment my network.
The eth2 is already a 10G NIC.

Have you tried assigning the desired addresses to the containers for eth2?

The eth1 for vm sounds like something to vfio and should not show up under your network interface at all.

I presume eth0 is functioning as desired already.

Edit: corrected eth#s

Edited November 26, 2025Nov 26 by Veah

@Veah thank you for your answer.
Yes, eth0 is working fine. I have webgui access.

The VM on eth1 uses the virtio Network Model and br1.4.
It is reachable and show up on my DHCP-Server.

Yes, I tried to assign IPs....the container starts but doesn't show up on my DHCP-Server and is not reachable.

I attach my config for the NICs:

ETH0

E

ETH1:

ETH2

Docker does not properly receive DHCP addresses right so I just work around by manual assign on both DHCP end and the eth1 assignment. Silly but works in my case.

Also assign your IP to eth2.

I imagine things should start talking after that.

it would be simpler to put eth1&2 on a untagged port.

If you have several interfaces unraid don't need to be vlan aware.

You can use one interface with sub interfaces in each desired vlan (that's what i do) or several interfaces, each one in the desired vlan.

@Veah Ahh yeah, I read about that. But how do you manual assign on the DHCP-Server?
U need a least a MAC-Address....are you using a macvlan docker network?

Thanks

@caplam yes, I know....it is more a relict from an old setup. I deleted the VLANS and set-up Access-Ports on my switch.

I get the mac address by console into the container and ifconfig. With the mac from there, create your dhcp entry which is more of a placeholder than anything else. After thats done, you can ping from within the router and then a status should show the connection up. I emphasize that the dhcp is mostly fluff unless you have a completely open ip assignment range. As for mac/ipvlan, I have done it with both.

Hmmm.... I did that, despite it is not really the perfect solution because after every redeploy (e.g. updates) you get a new mac-address.
But nevertheless I added the mac-address to my OPNsense DHCP config. It was pingable and the DHCP entry showed "active"...but I could not reach it....that's weird.

Mac addresses in my containers have kept since 6.12 so not sure about that. Sometimes I need to do the ping to make the connection show green (in pfsense). It's been kind of peculiar and sometimes I question what I am actually trying to accomplish by messing with it. It's like losing sight of the forest through all the trees.