AshleyNL wrote

 

IPv4 Routing Table

Refresh

Protocol	Destination Network	Next Hop	Distance	Metric	Interface Name

Static	0.0.0.0/24	192.168.2.254	1	0	VLAN70
Connected	192.168.0.0/24	192.168.0.1	0	1	VLAN1
Connected	192.168.2.0/24	192.168.2.1	0	1	VLAN70
Connected	192.168.30.0/24	192.168.30.1	0	1	VLAN30
Connected	192.168.100.0/24	192.168.100.1	0	1	VLAN100

Total: 5

Your router is in broadcast domain 192.168.2.0/24 VLAN 70, your default route points the router, but your network route points to 192.168.2.1, the switch's VIF. That's pretty weird. Either remove the 192.168.2.0 route (the default route already takes care of it) or – even better – use a different transit VLAN or a routed port to connect the remaining networks to the router. The VLAN 1 route routes traffic to the VIF, but I'm not sure what you want to achieve with this VLAN 1.

What you probably want, is something like this:

This topology uses a routed port for communication with the router (just to save a VLAN, but you could also use a VLAN if you want).

You have three subnets. The switch must have at least one VLAN interface (VIF) in each subnet to do routing. The gateway to VLAN 30 is VIF 192.168.30.1, that's an interface assigned to the VLAN (just imagine it's »the switch« in this network). The gateway to VLAN 70 is VIF 192.168.70.1 (imagine it's »another« switch in this network).

The gateway to every other destination (Internet) is the router with IP 172.16.0.1. To reach this third network, another VIF is needed (either a VLAN, say 172, or a routed port with an IP from the 172.16.0.0 network, imagine this as the »third« switch).

The default gateway of the switch therefore is the router with IP 172.16.0.1. Since the routed port (or VLAN) has a VIF, the switch knows how to reach the default gateway in network 172.16.0.0. For clients in VLANs 30 and 70 their default gateway is the VIF of the switch inside their network, that's 192.168.30.1 resp. 192.168.70.1.

Now, how can the router reach clients in VLAN 30 and 70? It needs to send traffic back to the switch. Thus, the router needs two network routes pointing to the gateway for the VLANs inside the router's network, that's the switch's VIF 172.16.0.254.

Do you see the problem of your original setup? You had a router inside an already switch-routed network.

Burczymucha wrote

The PVID is by default set to 1 and this is what I'm using on all access ports (and to this VLAN belongs all untagged traffic). VLAN 2 is tagged for VoIP on access ports.

That's a wrong setup if all your PVIDs are 1.

Access ports need to be a member of only one VLAN (say, 2) and their PVID needs to be 2 in this case. Any port which is a member of more than one VLAN becomes a trunk port and in most cases trunk ports handle tagged traffic destined to other VLAN-aware devices (except if you use tricky setups such as asymmetric VLANs).

Inside a managed switch there exists no »untagged traffic«. The switch always assigns a VLAN ID. Of course, on egress any traffic in every VLAN can be untagged too, that's needed to connect VLAN-unaware devices to a VLAN-aware switch. So it's not correct to say »VLAN 1 belongs to all untagged traffic«.

VLAN 1 is often the Default (also called Native or System) VLAN and it exists solely to have a VLAN for untagged traffic arriving on your switch over a trunk port. It has been introduced once to handle traffic from VLAN-aware servers which use protocols causing untagged traffic over a trunk port (among tagged traffic) such as protocols which exist in legacy servers from HP. A default VLAN also helps when migrating from a non VLAN-aware network to a VLAN-aware network. Thus, it is correct to say »inside VLAN networks there is no untagged traffic at all«.

The default VLAN is also used to assign so-far unconfigured ports to an initial VLAN, but it's just a normal VLAN as any other you define.

I suggest to remove access ports from the default VLAN if you assign them membership in any other VLAN except you use very special setups.

Always set the Port VLAN ID (PVID) to the VLAN to which untagged traffic should be directed.

AshleyNL wrote

I did not remove the ports from vlan 1, could that be part of the problem?

Unless you don't send traffic to VLAN 1 (by having an access port with PVID=1 or tagged traffic with VID=1 arriving over a trunk on the switch), it's no problem.

However, I don't use VLAN 1 at all except for unused ports and to drop untagged traffic arriving accidently over a trunk on a switch, caused by a wrong setup on a more distant switch. In smart and easy switches I can »drop« untagged traffic only by forwarding it to this (otherwise unused) VLAN 1. Thus, on my switches the PVID of trunk ports is 1, too. In managed switches (T series) I can configure a trunk to drop any untagged traffic, so VLAN 1 is unused on those switches.

Of course, you could use VLAN 1 for things like the management of VLAN-aware devices (switches, routers, APs, servers etc.) which are able to send traffic tagged with VID=1 back to the switch. You would then connect a management laptop to an access port with PVID=1 (or connect your admin laptop with a VLAN-aware interface to a trunk, so you can change networks on-the-fly by selecting different network profiles on your laptop). But you could also use VLAN 100 or whatever for this mgmt task.

It is important to note: there are no such things as »access ports« or »trunk ports« in the standard. It's just conventional to have such terms. The rules are:

• A port which is a member of only one VLAN is an access port. It's PVID equals the VLAN ID for this VLAN. Egress and ingress traffic of such ports is always untagged (outside the VLAN »domain«!).
• A port which is member of more than one VLAN is a trunk port. It's PVID defines to which VLAN untagged traffic (if any, but where from?!) is being forwarded. You can even drop untagged traffic arriving on a trunk. All devices (switches, routers, servers) connected to a trunk port need to be VLAN-aware. Traffic always is tagged (inside the whole VLAN »domain«).

My tip: for any VLAN design, draw a network topology with separate networks, separate switches, separat routers, separate servers, separate APs etc. much like you do for legacy (non-VLAN) networks. Then decide which switches, routers, servers, APs etc. are VLAN-aware and can handle all networks in only one device over only one cable (trunk). The outermost VLAN-aware devices on the edges of the VLAN-aware network start or terminate the VLAN »domain«. Thus, outside the VLAN »domain« there are no VLANs anymore, just networks handling always untagged traffic. Then create routes between those networks on their gateways just as you would do with non-VLAN networks.