diff --git a/scripts/ha/health.sh b/scripts/ha/health.sh
index f245721..d5a4a1e 100755
--- a/scripts/ha/health.sh
+++ b/scripts/ha/health.sh
@@ -11,7 +11,8 @@ NODE1="${NODE1:-ha-server-1}"
 NODE2="${NODE2:-ha-server-2}"
 NODE1_IP="${NODE1_IP:-192.168.2.228}"   # vars.haServer1Ip
 NODE2_IP="${NODE2_IP:-192.168.2.227}"   # vars.haServer2Ip
-VIP="${VIP:-192.168.20.229}"            # vars.haServerVip
+VIP="${VIP:-192.168.20.229}"            # vars.haServerVip (storage-client, VLAN 20 — internal only)
+VIP_LAN="${VIP_LAN:-192.168.2.229}"    # vars.haServerLanVip (LAN, VLAN 2 — reachable from workstation)
 XFS_MOUNT="${XFS_MOUNT:-/srv/ha-data}"  # vars.haStorageRoot
 HA_USER="${HA_USER:-nixos}"
 # ──────────────────────────────────────────────────────────────────────────
@@ -149,25 +150,45 @@ check_mount() {
 $REACHABLE_1 && check_mount "$NODE1" n1 || echo "  $NODE1  [OFFLINE]"
 $REACHABLE_2 && check_mount "$NODE2" n2 || echo "  $NODE2  [OFFLINE]"
 
-# ── Service ports via VIP ──────────────────────────────────────────────────
-section "Services via VIP ($VIP)"
-
-check_port() {
-  local name=$1 port=$2
-  if bash -c "echo >/dev/tcp/${VIP}/${port}" 2>/dev/null; then
-    printf "  %-10s  port %-5s  OK\n" "$name" "$port"
-  else
-    printf "  %-10s  port %-5s  UNREACHABLE\n" "$name" "$port"
-  fi
-}
-
-if ping -c1 -W2 "$VIP" >/dev/null 2>&1; then
+# ── LAN VIP (NFS) — reachable from workstation ────────────────────────────────
+section "LAN VIP ($VIP_LAN) — NFS"
+if ping -c1 -W2 "$VIP_LAN" >/dev/null 2>&1; then
   echo "  Ping       OK"
 else
   echo "  Ping       UNREACHABLE"
 fi
-check_port "NFS"    2049
-check_port "iSCSI"  3260
+if bash -c "echo >/dev/tcp/${VIP_LAN}/2049" 2>/dev/null; then
+  printf "  %-10s  port %-5s  OK\n" "NFS" "2049"
+else
+  printf "  %-10s  port %-5s  UNREACHABLE\n" "NFS" "2049"
+fi
+
+# ── Storage VIP (iSCSI) — VLAN 20 internal bridge, tested via active node ─────
+section "Storage VIP ($VIP) — iSCSI (via ${ACTIVE_NODE:-unknown})"
+
+run_active_raw() {
+  local active_ip=""
+  [[ "$ACTIVE_NODE" == "$NODE1" ]] && active_ip="$NODE1_IP"
+  [[ "$ACTIVE_NODE" == "$NODE2" ]] && active_ip="$NODE2_IP"
+  [[ -z "$active_ip" ]] && return 1
+  ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o ConnectTimeout=5 \
+    "${HA_USER}@${active_ip}" "$@" 2>/dev/null
+}
+
+if [[ -z "$ACTIVE_NODE" ]]; then
+  echo "  Cannot determine active node — skipping"
+else
+  if run_active_raw "ping -c1 -W2 '$VIP' >/dev/null 2>&1"; then
+    echo "  Ping       OK"
+  else
+    echo "  Ping       UNREACHABLE"
+  fi
+  if run_active_raw "bash -c 'echo >/dev/tcp/${VIP}/3260' 2>/dev/null"; then
+    printf "  %-10s  port %-5s  OK\n" "iSCSI" "3260"
+  else
+    printf "  %-10s  port %-5s  UNREACHABLE\n" "iSCSI" "3260"
+  fi
+fi
 
 echo ""
 echo "════════════════════════════════════════════════════"