VLANs connectig to non-vlans

[ricks03]

I have a CentOS 7 system running VirtualBox. The system is connected to a Cisco router with the interface configured to trunk, but with a native VLAN.

interface Vlan2
description internal LAN
ip address 192.168.2.1 255.255.255.0

interface FastEthernet0
switchport trunk native vlan 2
switchport mode trunk

The system was just configured normally, with no VLAN configuration on the NIC, and working fine. The base NIC was configured:
/etc/sysconfig/network-scripts/ifcfg-enp0s20
TYPE=Ethernet
BOOTPROTO=none
IPADDR=192.168.2.36
PREFIX=24
GATEWAY=192.168.2.1
DEFROUTE=yes
DNS1=8.8.8.8
DNS2=8.8.4.4
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
IPV6_FAILURE_FATAL=no
NAME=enp0s20
UUID=a148cf0e-9a47-4bd9-81d6-d84c956fa281
DEVICE=enp0s20
ONBOOT=yes
BRIDGE=br0

I am also running VirtualBox. The virtualbox was configured to use br0:
/etc/sysconfig/ifcfg-br0
DEVICE=br0
#STP=yes
TYPE=bridge
DELAY="0"
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
#IPV6_DEFROUTE=yes
#IPV6_FAILURE_FATAL=no
NAME=br0
UUID=8455a555-98f7-4432-adbe-068d4d477a8d
ONBOOT=yes
BRIDGING_OPTS=priority=32768
IPADDR=192.168.2.36
NETMASK=255.255.255.0
#PREFIX=24
GATEWAY=192.168.2.1
DNS1=8.8.8.8
DNS2=8.8.4.4
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
NM_CONTROLLED=yes


I want the VirtualBox system to be on a different network/VLAN, so I have created a vlan nic:
/etc/sysconfig/ifcfg-enp0s20.33
DEVICE=enp0s20.33
BOOTPROTO=none
ONBOOT=yes
IPADDR=10.33.33.32
PREFIX=16
NETWORK=10.33.0.0
GATEWAY=10.33.0.1
VLAN=yes

and configured the Virtual OS to be 10.33.33.33/16. The Virtual machine can ping the Internet, and other machines on the 192.168.0/24 network. Other machines on the 192.168.2.0/24 network can ping it back, and ping the IP address of the host (192.168.2.36). The host (192.168.2.36) can ping the VM at 10.33.33.33.

But the Virtual OS can't ping the Host. There are no ACLs on the switch, and no firewall/ip tables settings on the host. trace route from the virtual OS fail at the gateway. Given how everything else is working, I'm fairly confident traffic is making it to the gateway, and returning to the host which is not seeing the (tagged) traffic. I suspect I need to change something on the interface config on the host, but am stuck. Thoughts?