Fixing NAT After Inter-VLAN Routing: OS-Level VLAN Tagging on Windows with Hyper-V

The Problem with Inter-VLAN Routing and NAT

In the previous article, I configured L3 inter-VLAN routing on the USW Pro Max 16 PoE to bypass the Dream Machine SE’s 1Gbps backplane for PC-to-NAS traffic. NAS throughput jumped to 2.5Gbps as expected.

Then I noticed my gaming NAT had gone from Open to Moderate. Port forwarding for other services also stopped working reliably.

The root cause is asymmetric routing. With inter-VLAN routing enabled on the switch, some traffic takes a different path on the return leg than it did on the outbound leg. The DM’s NAT state tables track connections based on outbound flows — when return traffic arrives via a different path, the DM does not recognise the session and drops or misroutes it.

The fix is to stop using switch-level inter-VLAN routing entirely for the PC, and instead handle the VLAN separation at the OS level using Hyper-V virtual adapters.

The Goal

PC internet and gaming traffic: untagged Personal VLAN, routed by the Dream Machine as normal (Open NAT, port forwarding works)
PC to NAS traffic: tagged Geek VLAN, routed at switch speed without touching the DM
One physical NIC, one physical cable

How It Works

Windows Hyper-V lets you create virtual switches and adapters bound to a physical NIC. By creating a VLAN-tagged virtual adapter for the Geek VLAN and leaving the primary adapter untagged on the Personal VLAN, the PC sends two types of traffic out of a single physical port:

Untagged frames → Personal VLAN → Dream Machine → internet
VLAN 5 tagged frames → Geek VLAN → switch routes to NAS at 2.5Gbps

The switch port is configured as a trunk, allowing both.

Prerequisites

The previous inter-VLAN routing setup should be disabled (Personal VLAN should be routed by the DM, not the switch)
UniFi controller admin access
Windows PC with Hyper-V enabled
One NIC connected to the USW Pro Max 16 PoE

Phase 1: Configure the Switch Port as a Trunk

The PC’s switch port needs to carry both untagged Personal VLAN traffic and tagged Geek VLAN traffic.

In UniFi Network:

UniFi Devices > USW Pro Max 16 PoE > Ports

Select the port connected to the PC and:

Set Primary Network (native VLAN) to Personal
Under advanced VLAN settings, allow Geek Network (VLAN 5) as tagged on the same port
Apply and wait for the port to reprovision

If the port profile is already set to “Allow All”, VLAN 5 tagged traffic is already permitted. You only need the explicit setting if using a profile that whitelists specific VLANs.

Phase 2: Create the Tagged Virtual Adapter in Windows

Open PowerShell as Administrator.

Identify your physical adapter:

Get-NetAdapter | Where-Object { $_.Virtual -eq $false }

Note the Name value — you will need it in the next command.

Create an external Hyper-V virtual switch bound to the physical NIC:

New-VMSwitch -Name "PhysicalBridge" `
  -NetAdapterName "10G Nic" `
  -AllowManagementOS $true

Replace "10G Nic" with your actual adapter name. The -AllowManagementOS $true flag is required — without it, the host OS loses access to the network entirely via this adapter.

⚠️ New-VMSwitch briefly interrupts network connectivity while Windows rebinds the NIC. Expect a few seconds of disconnection.

Create a host virtual adapter for Geek VLAN traffic:

Add-VMNetworkAdapter -ManagementOS `
  -Name "Geek-VLAN" `
  -SwitchName "PhysicalBridge"

Apply VLAN 5 tagging to the new adapter:

Set-VMNetworkAdapterVlan -ManagementOS `
  -VMNetworkAdapterName "Geek-VLAN" `
  -Access -VlanId 5

Phase 3: Configure the Tagged Adapter IP (No Gateway)

Open Network Connections (ncpa.cpl) and find vEthernet (Geek-VLAN).

Open Properties > IPv4 and configure:

IP address: a static address in the NAS subnet — e.g. 192.168.55.20
Subnet mask: 255.255.255.0
Default gateway: leave empty
DNS: leave empty

Leaving the gateway empty is the critical part. Without a gateway on this adapter, Windows will only use it for routes within the Geek subnet (192.168.55.0/24). Internet traffic continues to route via the primary untagged adapter and the Dream Machine. There is no routing conflict.

Verification

Check the tagged adapter has the expected IP:

Get-NetIPAddress -InterfaceAlias "vEthernet (Geek-VLAN)" -AddressFamily IPv4

Check NAS subnet routes to the tagged adapter:

route print

Find the 192.168.55.0 route and confirm it points to vEthernet (Geek-VLAN).

Ping the NAS:

ping 192.168.55.14

Check gaming NAT: Launch a game that shows NAT type (Call of Duty, for example). It should return to Open NAT once the Personal VLAN is back to being routed entirely by the DM.

Test NAS throughput: Run a large file transfer to the NAS and confirm you are back at ~2.5Gbps.

Rollback

If anything goes wrong:

# Remove the tagged adapter
Remove-VMNetworkAdapter -ManagementOS -Name "Geek-VLAN"

# Remove the virtual switch (restores direct NIC binding)
Remove-VMSwitch -Name "PhysicalBridge" -Force

Then restore the UniFi port profile to its previous setting.

Troubleshooting

Symptom	Check
No NAS connectivity	Confirm VLAN 5 is allowed on the switch port; check tagged adapter VLAN ID is `5`
Internet breaks after switch creation	Wait for NIC rebind (~10s); verify primary adapter still has correct gateway
NAT still Moderate/Strict	Confirm Personal VLAN is not using switch inter-VLAN routing; check DM is the gateway for that VLAN
Traffic still hairpins through DM	Check `route print` — Geek adapter should have no default gateway and correct subnet mask
NAS throughput lower than expected	Verify switch port is trunk (not access-only), confirm 2.5G link speed on both ends

Why This Beats Switch-Level Inter-VLAN Routing for This Use Case

Switch-level inter-VLAN routing gives you throughput but breaks NAT. OS-level VLAN tagging gives you both: 2.5Gbps to the NAS and a clean routing path for the Dream Machine’s NAT to track internet connections correctly.

The tradeoff is that it requires Hyper-V on the Windows machine. If you are on Linux, the same approach works with ip link add link eth0 name eth0.5 type vlan id 5 — no virtual switch needed.

Related: