Odd VLAN behavior between tagged and untagged clients to TN

Hi I’m trying to get everything working consistently for the following setup:

TrueNAS Core 13.0-U6.7
ix0 Intel 10gb interface, hardware offloading disabled, no IP
vlan for “main” traffic: vlan1, parent is ix0, no other settings, no IP
vlan for private traffic: vlan2, parent is ix0, no other settings, no IP
bridge1 with members vlan1 and vnet0, no other settings, IP 192.168.1.12/24
bridge2 with members vlan2, no other settings, IP 10.1.1.12
vnet0 for a Linux VM, the IP inside the VM is 192.168.1.13, vnet0 is in the tap group

Connection coming in to ix0 is tagged with vlanIDs 1 and 2, VMware ESX is connected with tagged 1 and 2 as well, everything else in the home network is untagged. The switch has the default/untagged VLAN set to 1. Wifi AP (Eero mesh) is connected to the core switch via an untagged port. There are no “vlan relearning” issues with the roaming AP connections since I’ve funneled all the APs through one managed port

Here’s the odd bit, everything works except for untagged clients. All VLAN2 traffic and connections work within. And all traffic for VLAN1 works from clients that pass through a trunked connection, such as VMs in ESX, or a mac on the untagged switch via the trunk uplink to the core switch. But wifi for instance can’t connect to 192.168.1.12, or it can for a minute or so, then goes back to “host is down” or just into the network black hole. What’s bizarre is that these same clients can connect to the Linux VM on vnet0, which is a member of bridge1 along with vlan1, 192.168.1.13. No problems there. Is there anything I’m missing with my setup? I’ve searched the historical community site and followed as much best practice as I could understand. I’m not a BSD networking guru but I’m fairly experienced with networking. This is got me scratching my head

Here’s my ifconfig

root@truenas[~]# ifconfig -a
re0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE>
        ether 18:c0:4d:87:79:cf
        media: Ethernet autoselect (none)
        status: no carrier
        nd6 options=9<PERFORMNUD,IFDISABLED>
ix0: flags=8963<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8138b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWFILTER>
        ether a0:36:9f:1a:51:fc
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=9<PERFORMNUD,IFDISABLED>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
        inet 127.0.0.1 netmask 0xff000000
        groups: lo
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
pflog0: flags=0<> metric 0 mtu 33160
        groups: pflog
vlan1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether a0:36:9f:1a:51:fc
        groups: vlan
        vlan: 1 vlanproto: 802.1q vlanpcp: 0 parent interface: ix0
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=9<PERFORMNUD,IFDISABLED>
vlan2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether a0:36:9f:1a:51:fc
        groups: vlan
        vlan: 2 vlanproto: 802.1q vlanpcp: 0 parent interface: ix0
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=9<PERFORMNUD,IFDISABLED>
bridge1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 58:9c:fc:00:23:21
        inet 192.168.1.12 netmask 0xffffff00 broadcast 192.168.1.255
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: vnet0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 9 priority 128 path cost 2000000
        member: vlan1 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 5 priority 128 path cost 2000
        groups: bridge
        nd6 options=9<PERFORMNUD,IFDISABLED>
bridge2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 58:9c:fc:00:0f:4d
        inet 10.1.1.12 netmask 0xffffff00 broadcast 10.1.1.255
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: vlan2 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 6 priority 128 path cost 2000
        groups: bridge
        nd6 options=9<PERFORMNUD,IFDISABLED>
vnet0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=80000<LINKSTATE>
        ether fe:a0:98:4b:27:dd
        hwaddr 58:9c:fc:10:ff:c7
        groups: tap
        media: Ethernet autoselect
        status: active
        nd6 options=9<PERFORMNUD,IFDISABLED>
        Opened by PID 1878

I think I got things running but I feel like it’s a kludge. I followed the guidance in a post from the historical community site (why can’t we put links in posts?) to do the tunables for bridge0, deleting bridge1, and putting the 192.168.1.12 IP on the vlan1 interface. Rebooting put everything just as the final ifconfig in that post had

root@truenas[~]# ifconfig -a
re0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=8209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE>
	ether 18:c0:4d:87:79:cf
	media: Ethernet autoselect (none)
	status: no carrier
	nd6 options=9<PERFORMNUD,IFDISABLED>
ix0: flags=8963<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=8138b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWFILTER>
	ether a0:36:9f:1a:51:fc
	media: Ethernet autoselect (10Gbase-T <full-duplex>)
	status: active
	nd6 options=9<PERFORMNUD,IFDISABLED>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
	options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
	inet6 ::1 prefixlen 128
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
	inet 127.0.0.1 netmask 0xff000000
	groups: lo
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
pflog0: flags=0<> metric 0 mtu 33160
	groups: pflog
vlan1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
	ether a0:36:9f:1a:51:fc
	inet 192.168.1.12 netmask 0xffffff00 broadcast 192.168.1.255
	groups: vlan
	vlan: 1 vlanproto: 802.1q vlanpcp: 0 parent interface: ix0
	media: Ethernet autoselect (10Gbase-T <full-duplex>)
	status: active
	nd6 options=9<PERFORMNUD,IFDISABLED>
vlan2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
	ether a0:36:9f:1a:51:fc
	groups: vlan
	vlan: 2 vlanproto: 802.1q vlanpcp: 0 parent interface: ix0
	media: Ethernet autoselect (10Gbase-T <full-duplex>)
	status: active
	nd6 options=9<PERFORMNUD,IFDISABLED>
bridge2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	ether 58:9c:fc:00:0f:4d
	inet 10.1.1.12 netmask 0xffffff00 broadcast 10.1.1.255
	id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
	maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
	root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
	member: vlan2 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
	        ifmaxaddr 0 port 6 priority 128 path cost 2000
	groups: bridge
	nd6 options=9<PERFORMNUD,IFDISABLED>
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	ether 58:9c:fc:10:ff:a8
	id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
	maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
	root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
	member: vnet0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
	        ifmaxaddr 0 port 9 priority 128 path cost 2000000
	member: vlan1 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
	        ifmaxaddr 0 port 5 priority 128 path cost 2000
	groups: bridge
	nd6 options=9<PERFORMNUD,IFDISABLED>
vnet0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=80000<LINKSTATE>
	ether fe:a0:98:4b:27:dd
	hwaddr 58:9c:fc:10:ff:c7
	groups: tap
	media: Ethernet autoselect
	status: active
	nd6 options=9<PERFORMNUD,IFDISABLED>
	Opened by PID 1876