NetPlan configured VLAN in Ubuntu 18.04 cannot ping

Question

I have an Ubuntu 18.04 server in AWS EC2, running Docker.

I want to have separate network cards for each Docker container, as the app inside them needs to use the same port (5003).

I added some private IPs to the server via the EC2 console, and connected each to an Elastic IP (i.e. a public IP). All are using the same security group (port configuration).

I then used SHH to create a yaml configuration file for some VLANs:

network:
  version: 2
  renderer: networkd
  vlans:
      vlan10:
          id: 10
          link: eth0
          addresses: [ "172.31.40.22/16" ]
      vlan20:
          id: 20
          link: eth0
          addresses: [ "172.31.40.23/16" ]
      vlan30:
          id: 30
          link: eth0
          addresses: [ "172.31.40.24/16" ]

...and ran sudo netplan --debug apply to merge this with the config file for the interface (eth0):

# This file is generated from information provided by the datasource.  Changes
# to it will not persist across an instance reboot.  To disable cloud-init's
# network configuration capabilities, write a file
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
# network: {config: disabled}
network:
    ethernets:
        eth0:
            dhcp4: true
            dhcp6: false
            match:
                macaddress: 0a:c5:f8:3a:a4:28
            set-name: eth0
    version: 2

to make:

DEBUG:Merged config:
network:
  ethernets:
    eth0:
      dhcp4: true
      dhcp6: false
      match:
        macaddress: 0a:c5:f8:3a:a4:28
      set-name: eth0
  renderer: networkd
  version: 2
  vlans:
    vlan10:
      addresses:
      - 172.31.40.22/16
      id: 10
      link: eth0
    vlan20:
      addresses:
      - 172.31.40.23/16
      id: 20
      link: eth0
    vlan30:
      addresses:
      - 172.31.40.24/16
      id: 30
      link: eth0

The VLANs all show up when I run IP add

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP group default qlen 1000
    link/ether 0a:c5:f8:3a:a4:28 brd ff:ff:ff:ff:ff:ff
    inet 172.31.40.21/20 brd 172.31.47.255 scope global dynamic eth0
       valid_lft 2317sec preferred_lft 2317sec
    inet6 fe80::8c5:f8ff:fe3a:a428/64 scope link 
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:5d:6a:d5:15 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
4: vlan20@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 0a:c5:f8:3a:a4:28 brd ff:ff:ff:ff:ff:ff
    inet 172.31.40.23/20 brd 172.31.47.255 scope global vlan20
       valid_lft forever preferred_lft forever
    inet6 fe80::8c5:f8ff:fe3a:a428/64 scope link 
       valid_lft forever preferred_lft forever
5: vlan30@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 0a:c5:f8:3a:a4:28 brd ff:ff:ff:ff:ff:ff
    inet 172.31.40.24/20 brd 172.31.47.255 scope global vlan30
       valid_lft forever preferred_lft forever
    inet6 fe80::8c5:f8ff:fe3a:a428/64 scope link 
       valid_lft forever preferred_lft forever
6: vlan10@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 0a:c5:f8:3a:a4:28 brd ff:ff:ff:ff:ff:ff
    inet 172.31.40.22/20 brd 172.31.47.255 scope global vlan10
       valid_lft forever preferred_lft forever
    inet6 fe80::8c5:f8ff:fe3a:a428/64 scope link 
       valid_lft forever preferred_lft forever

My problem is that eth0 can happily ping an internet address, but the VLANs cannot ping anything (not an internet address, not eth0, and not each other).

Can anyone help me with what I've missed? Do I need to specify a default gateway? Have I badly misunderstood VLANs?

Answer 1

I think that's missing routes, like this:

...
vlans:
  vlan10:
  addresses:
    - 172.31.40.22/16
  id: 10
  link: eth0
  routes:
    - to: 0.0.0.0/0
    via: <your eth0 gateway ip xxx.xxx.xxx.xxx>
    metric: 100