Manual

One VLAN without internet

The rest of the network is fine, but one VLAN does not get out. Nearly always a tick box or a missing tag.

The guest network is dead. Or the cameras, or the desks on the second floor. The devices do get an address, or do not get one at all, but they never reach the outside, while the rest of the house or office notices nothing.

This is almost never a problem with your internet connection: that one works for the other VLANs. It comes down to one of four things. The VLAN has no router address, the tag does not reach the port, a rule is stopping it, or there is no DHCP at all. If everything is without internet, read No internet after applying instead.

The quick checks, in this order

  1. Does the device get an address from the right range? Look on the device, or on the router with /ip dhcp-server lease print. A good answer: a lease in that VLAN's subnet, on that VLAN's DHCP server. If it gets an address from another VLAN, go to An address from the wrong range.
  2. Does the router have an address in that VLAN? /ip address print. A good answer: a line with the interface vlan30-iot, or whatever you called it. If it is missing, this VLAN is layer 2 only and there is nothing to route to.
  3. Can a device reach the router? Ping that VLAN's router address from a device inside it. If that fails, this is a tagging problem and not a firewall problem.
  4. Is the tag on the port? /interface bridge vlan print. A good answer: the VLAN id is in the table, with the trunk ports under tagged and the access port under untagged. A missing id means the traffic stops at the bridge.
  5. Is the firewall stopping it? /ip firewall filter print stats. A good answer: the counters on the drop rules for this VLAN stay still. A counter climbing on a rule commented vlan30-iot: no internet or isolate vlan30-iot is your answer.
  6. Is anything arriving? /tool torch interface=vlan30-iot shows live what passes that interface. Nothing there while a device is plugged in means the traffic never reaches the router.

The usual causes

  • The Internet tick is off. In the VLANs section every row has an Internet tick. Off means a drop rule towards WAN, exactly as designed, and easy to forget. The rule carries the VLAN's name as its comment, so you spot it at once in the firewall.
  • The VLAN has no router address. Leaving Router address empty means layer 2 only: no address, no DHCP, no route out. That is the right answer for a VLAN you only hand to another router, and the wrong one for a network with users in it.
  • The tag does not make it past the trunk. A VLAN you add after assigning the ports also has to be on the trunk. The tool adds a new VLAN to every trunk port automatically, but if you removed a tag by hand afterwards, this VLAN stops there.
  • Isolation does more than you thought. Isolated means no traffic to other VLANs, internet allowed, so it does not block the internet by itself. But with the VLAN matrix on, the matrix decides everything and the Isolated tick is not used; the tool says so when that happens.
  • DHCP is off for this VLAN. Devices then invent an address in 169.254.x.x and go nowhere.

What the configurator does about it

With several devices in one site, the tool compares the VLANs at both ends of every cable. If the router carries VLAN 30 and the switch does not, you get a warning naming both devices and both ports: that VLAN stops at the cable. That is this exact problem, one step earlier. See Checks about VLANs.

Two related checks sit next to it. If no VLAN has a router address while the device does route, the tool says the router will not route between VLANs. And if the first VLAN in the site table is marked isolated, that is an error: wired ports default to the first VLAN, so your whole wired network would land on the guest network.

What the tool does not do is notice that the Internet tick is off by accident. It is a valid choice, and the tool cannot know what you meant. So run down the list before you paste: the Internet column belongs on for every network with people in it.

When it is not your router

  • The switch in between does not know the VLAN. An unmanaged switch usually passes tagged traffic, but not always. A managed switch with its own VLAN table certainly will not until you teach it the VLAN.
  • The access point broadcasts the SSID on the wrong VLAN. The site check reports this: SSID guest belongs on VLAN 20, but ap-01 does not carry that VLAN.
  • The device has a firewall of its own. A camera or a till system with its own filter can want to reach out and forbid itself.

Further reading: VLANs, Firewall and NAT and Bridge and ports.

Want to try it right away? Open the configurator