The DB VMs can't reach the network
A hypervisor bridge fans two VLANs of VMs out to the physical NIC over a trunk. Web VMs reach the network; the DB VMs don't. Fix the trunk.
Scenario
A hypervisor runs a VLAN-filtering bridge. Two web VMs sit in VLAN 10, a DB VM sits in VLAN 20, and
the host's physical NIC eth0 is a trunk uplink that should carry both VLANs (tagged) out to
the physical switch.
The web VMs reach the rest of the network fine. The DB VM can't reach anything beyond the host. Its frames never make it out the uplink.
Topology (one bridge br0, VLAN filtering on)
vm-web1,vm-web2: access ports, VLAN 10vm-db1: access port, VLAN 20eth0: trunk uplink to the physical switch, should tag VLAN 10 and VLAN 20
Your job
Make the uplink trunk carry both VLANs, so the DB VM reaches the physical network too, without breaking VLAN isolation between web and DB.
What "done" looks like
eth0 carries VLAN 10 and VLAN 20 tagged; web VMs and the DB VM each reach the uplink in their own
VLAN; web and DB VMs remain isolated from each other.
Teaches: access ports vs. trunk ports on a Linux bridge: an uplink must explicitly carry every VLAN it should trunk, or that VLAN is stranded on the host.
What gets checked
Your solution is verified against each of these:
- The uplink (eth0) carries both VLAN 10 and VLAN 20 toward the physical network
- The web VMs (VLAN 10) reach the uplink
- The DB VMs (VLAN 20) reach the uplink
- Web and DB VMs stay isolated from each other
Solve it in your browser
No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.
Solve in browser →Prefer your own lab?
- Build the fix locally. New to the tooling? See setting up your lab.
- Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
- Submit the repo link. We review it by hand, confirm it works, and issue your proof page.