Trying to move HA to a VLAN - and failing miserably!

Installation
1

I have had HA up and running on my LAN for years. I’ve recently stared segregating my network into VLANs. I have moved most of my smart devices to VLAN_IoT (20) and my trusted phones, servers, etc. to VLAN_Trusted (10). I would like HA on VLAN_Trusted, and I believe I have all of the necessary firewall rules set up, along with mDNS.

My HA instance runs in VMWare Fusion on a Mac Mini M4 Pro. I’ve tried every iteration of adding/changing the VMWare network adaptors that I can think of, as well as adding/changing the settings in HA > Settings > System > Network. But as soon as I remove the LAN adaptor and keep only the VLAN_Trusted adaptor, everything goes to crap.

Does anyone have any suggestions? Please and thank you!

image
image1285×1193 129 KB

2

I see you’re using Ubiquiti—a UDM? It’s probably a firewall issue. Start with the firewall wide open for all VLANs to get everything working first. Then, slowly add your rules one by one.

3

I am not sure because I do not use Ubiquiti and am just moving to VLAN myself, but from your screenshot it looks like HA is fine and you can access it.
The error seems to show a rpoblem with your ubiquiti extension. Try removing that from your config for now and reboot. If everything works fine without that, you can check what the problem with your ubiquti config in HA is.

4

Hi.

Before anyone can reasonably identify the cause of the problem, a few more details about the network configuration would be useful.

First, could you describe the Home Assistant VM networking in VMware Fusion in more detail:

  • how many network interfaces the VM currently has,
  • what mode each interface is using,
  • where the VLAN tagging is being done,
  • what IP address, subnet mask, default gateway, and DNS HA gets when only the VLAN_Trusted interface is left,
  • whether HA can ping the VLAN_Trusted gateway, a device in VLAN_IoT, and an Internet address in that state.

It would also be very useful to clarify what exactly you mean by “everything breaks.” Do you lose access to the Home Assistant GUI, does HA lose Internet access, does communication with IoT devices stop working, does only automatic device discovery fail, or is the problem limited to the Ubiquiti integration?

Screenshots or a description of the Ubiquiti network and firewall configuration would also help: VLANs and subnets, zone assignments, rules between VLAN_Trusted and VLAN_IoT, and the mDNS configuration.

At this stage it is difficult to determine whether the issue is in VMware, routing, the firewall, or discovery mechanisms. First I would verify that after removing the old interface, HA still has a correct IP configuration and proper Layer 3 connectivity.

As a side note, there is one more thing worth keeping in mind for the future. Even if routing and firewall rules between VLAN_Trusted and VLAN_IoT are configured correctly, that does not automatically mean Home Assistant will be able to discover every device located in another VLAN. Many integrations use discovery mechanisms such as mDNS/Zeroconf, SSDP, multicast, or broadcast, which do not cross subnets in the same way as normal unicast traffic.

So you may encounter a situation where HA can communicate with a device perfectly well once its IP address is known, but cannot discover it automatically. An mDNS reflector may solve some of these cases, but not necessarily all of them, because different integrations use different discovery mechanisms.

This may not be the cause of your current problem, but with an architecture where HA is in VLAN_Trusted and all IoT devices are in a separate VLAN_IoT, it is something worth keeping in mind while troubleshooting.

5

Thank you all for the feedback! I think that was kind of an unfair screenshot because it only showed a small portion of the errors. I do have UniFi APs and switches, but my router/firewall is OPNsense. That error list was essentially every integration I have failing all at once.

@robert_gorajski

  • Prior to my attempted VLAN changeover (and also currently because I reverted back) the VM has 2 network interfaces - LAN (ethernet) and VLAN_Trusted.
  • I’m not 100% sure what you mean by interface mode - But if this answers it - the port on my Ubiquiti switch is the default LAN/allow all
  • The VLAN tagging is in OPNsense, and added in my UniFi OS Server. VLANs are working correctly on all connected devices
  • Sometimes it was still retaining the original IP with 192.168.1.0/24 and other times it was the new 192.168.10.0/23. I don’t remember which configuration led to which outcome off hand.
  • I didn’t try a ping at the time. Sorry.

That screenshot I posted was the best I could get out of HA. The GUI would come up but everything - and I mean everything - failed to load. Other times it would just not resolve. And unfortunately I don’t recall which iteration of my experimentation let to which result.

I think I am going to have to give this thing another whirl and take notes as to which configurations led to which results. But for now, do you have any suggestions/recommendations on how I can make this move the right way?

Oh, and one more thing - Eventually I plan to completely move this Mac Mini to VLAN_Trusted. I would do it directly at the port, so what today is Ethernet/Lan would become Ethernet/VLAN_Trusted. I wonder if that would eliminate some possible networking ick since VMWare Fusion would still see it as the same network interface. And per your other comments about IoT, I am thinking I might add another interface to the VM for that VLAN so HA can see those devices more easily.

Thank you for all of your help!!

6

VLANs split the broadcast domain into smaller pieces.
Broadcast domains are not handled with firewall rules.
Firewall rules act on unicast packets.
Broadcast use broadcast packets.
Broadcast packets are per definition not routable with standard IP routing.

7

I think I figured it out. It was order of operations. I was removing the network interface from VMWare Fusion first, and then trying to load HA. But HA still expected that interface, so it failed. Tonight I removed the interface from HA first and restarted, and it was still happy. So then I shut it down and removed it from VMWare Fusion. Everything is still good after a reboot, so I think I am good!

The only issue - which I think is what you were pointing out about VLANs - is my Govee Local integration. Without the LAN, it won’t connect. I think I’ll be ok once I move those device to the IoT VLAN and then add that network interface into HA.