So close: problem with untagged and tagged traffic routing

I'm trying to set up an HCI system that has three different networks on an ESX host.

What's happened so far:

The hosts came up and grabbed a DHCP address and work fine.

The installer VM is set (by factory) to 192.168.10.200/24

The ports are set as switchport trunk, no other settings.

The VLANs are created, with .1 as the VLAN ip.

​

The behavior is this: the install VM on 192.168.10.200 can't get anywhere if the VM Network inside ESX is set to untagged/0. It can't ping 192.168.10.1, which is the VLAN on the same switch. However if I tag the ESX network into 192 (VLAN ID) it can ping that address and route around the network. There's something basic I'm missing here, is it that the default VLAN is a different network, and untagged traffic is trying to hit that address (10.12.1.x/24) and being discarded?

The desired outcome is that the host can talk on its DHCP lease (10.12.1.x) and the VM can talk on it's preconfigured IP (192.168.10.x) over the same port, untagged.