Tally Server Not Working Across VLANs? Here’s the Fix

Tally server connectivity across VLANs is a common networking challenge in small office environments. This article is part of our complete networking, VPN and remote access guide, which also covers WiFi, VPN setup, and remote desktop fixes.

 Method 1: Tally Server client Model on different VLAN

If you have ESX server and Tally virtual server hosted on it. Create a separate Vswitch and add a dedicated physical network adapter,specify the VLAN ID for this port group which is same the client side VLAN ID
Add the Tally Virtual server network card to connect to this Vswitch. Assign the IP Address to Tally server with the same range of client PC.

Now connect the ESX host physical network adapter to the Physical switch to a port, then you have to configure the switch port to Access mode and allow the client VLAN to access this port.

Now the Client PC will be able to detect the Tally server and License will be assigned.

Method 2: Enable Terminal service on Tally Server.

Tally server should be enable with Terminal services, Multiple users can do a remote desktop connection to the server. But this solution will be expensive cost involved with Terminal service License and Windows Licenses.

Copy and paste the following content directly into your WordPress block editor to replace or expand your current draft:

Why Tally Fails to Auto-Discover Across VLANs

Tally ERP 9 and TallyPrime rely on UDP broadcast packets to advertise their presence and discover the license server on a local area network (LAN). By design, routers and Layer 3 switches drop broadcast packets at subnet boundaries to prevent broadcast storms.

When your Tally Server sits on an isolated server subnet (e.g., VLAN 10 - 192.168.10.0/24) and client workstations sit on an office subnet (e.g., VLAN 20 - 192.168.20.0/24), client machines cannot dynamically “see” the Tally gateway. Resolving this requires either multi-homing the server or enabling direct Layer 3 communication paired with static IP configuration.

Method 1: Multi-Homing the Tally Virtual Machine (VMware ESXi / Hyper-V)

If your Tally server is hosted as a virtual machine inside VMware ESXi or Microsoft Hyper-V, you can bypass router hops entirely by attaching a secondary virtual network adapter:

• Create a Port Group: In your hypervisor, create or verify a virtual switch port group tagged with the client VLAN ID (VLAN 20).
• Attach a Secondary vNIC: Edit the Tally VM settings and add a second network adapter mapped to this client port group.
• Assign a Static IP: Configure the second adapter with an unused static IP inside the client subnet (192.168.20.50, subnet mask 255.255.255.0).
• Important: Do not assign a Default Gateway on this secondary adapter. Windows only supports a single active default gateway; assigning two creates routing loops and dropped packets.

Method 2: Layer 3 Inter-VLAN Routing & Gateway Traversal

If adding a network interface is not viable—or your Tally server is a physical machine—you must route traffic across your Layer 3 switch or firewall (Fortinet, Sophos, Cisco, pfSense).

1. Inter-VLAN Access Control Lists (ACLs)

Verify that your core switch or firewall policy permits bidirectional traffic between the subnets on the required ports:

Parameter	Source (Client VLAN)	Destination (Tally Server VLAN)
IP Subnet	192.168.20.0/24	192.168.10.15 (Tally Host IP)
Protocols	TCP & UDP	TCP & UDP
Port Numbers	Any ephemeral port	9000 (Default Tally Port), 445 (SMB Data Share)
Action	Permit / Allow	Permit / Allow

2. Routing Verification

From a client workstation on VLAN 20, open Command Prompt or PowerShell and verify raw Layer 3 connectivity:

PowerShell

ping 192.168.10.15
Test-NetConnection -ComputerName 192.168.10.15 -Port 9000

If the ping responds but Test-NetConnection fails on port 9000, the Windows Firewall on the Tally host is actively dropping non-local subnet packets.

Configuring Windows Firewall on the Tally Host

By default, Windows Defender Firewall blocks inbound connections originating from outside the local subnet, even if file sharing is turned on.

1. Inbound Port Rule for Tally License & Gateway

1. Open Windows Defender Firewall with Advanced Security (wf.msc) on the Tally server.
2. Click Inbound Rules > New Rule.
3. Select Port > Click Next.
4. Choose TCP and specify port: 9000 (or your custom Tally port).
5. Select Allow the connection.
6. Check Domain, Private, and Public network profiles.
7. Name the rule: Tally Server Port 9000 - Cross VLAN.

2. Inbound Application Rules

Repeat the process to create executable-level exceptions for Tally binaries:

• Program Path 1: C:\Program Files\TallyPrime\tally.exe
• Program Path 2: C:\Program Files\TallyPrime\tallylicserver.exe (if running Tally Server 9)

3. Scope Verification

Double-click your new firewall rule, navigate to the Scope tab, and ensure Remote IP address is set to Any IP address (or explicitly enter your client subnet range 192.168.20.0/24). If set to “Local Subnet,” cross-VLAN clients will be blocked.

Configuring Client-Side Tally.ini & Manual License Connection

Because cross-subnet broadcast packets do not reach the client, you must instruct each client installation of Tally to point directly to the server’s static IP.

Option A: Through TallyPrime GUI

1. Launch TallyPrime on the client workstation.
2. When prompted with license error screens, click F1: Help > Settings > License > Manage License.
3. Select Configure Existing License.
4. Set Configure license manually to Yes.
5. Enter:
   • Server Name / IP:192.168.10.15
   • Port:9000
6. Press Enter to save. Tally will directly poll the host IP and activate successfully.

Option B: Directly Editing Tally.ini (Best for Bulk IT Deployments)

If deploying across multiple domain workstations, edit the configuration file directly:

1. Close Tally on the client computer.
2. Navigate to the Tally installation directory (e.g., C:\Program Files\TallyPrime\).
3. Open Tally.ini in Notepad with Administrator rights.
4. Locate or update the following parameters:

Ini, TOML

;; Tally Server Connection Settings
TallyLicenseServer = 192.168.10.15:9000
Data = \\192.168.10.15\TallyData

5. Save the file and restart TallyPrime.

SMB Data Folder Permissions & Name Resolution

If client machines open company data hosted on the server over a network share (\\TallyHost\TallyData), NetBIOS name resolution may fail across different subnets.

• Use Static IPs Instead of Hostnames: Map the network drive using the host IP address (e.g., \\192.168.10.15\TallyData) rather than NetBIOS names (\\TALLY-SERVER\TallyData) unless a reliable internal DNS/WINS server is configured.
• Verify SMB Port 445: Ensure TCP port 445 and UDP/TCP port 137–139 are allowed across your inter-VLAN firewall rules so client workstations can read/write data files without latency or permission timeouts.
• Share and NTFS Permissions: On the Tally host, ensure the shared data folder grants Modify permissions to the authenticated Active Directory domain users or local server users operating the remote clients.

For more on VLAN configuration, VPN setup, and corporate network troubleshooting, see our full networking and VPN guide.