I need help moving over to using our layer 3 switch as the inter vlan routing device rather than our cisco router. I've mostly got it working but I've got stuck near the end and need some advice (I think I just need a bit of education on the subject really). Cur

I have a Dell PowerConnect 7048 connecting to a Cisco 1841 router. I've got a few key excerpts from the configs to provide the key information. On the powerconnect I have the following:

ip routing
ip default-gateway 172.31.14.1
ip route 0.0.0.0 0.0.0.0 172.31.14.1 253
!
interface vlan 1
ip address 172.31.14.254 255.255.255.0
exit
interface vlan 2
ip address 172.31.19.254 255.255.255.0
exit
interface vlan 4
ip address 172.31.16.254 255.255.255.0
!
interface Gi1/0/1
description 'Link to L7Router01'
switchport mode trunk
switchport trunk allowed vlan except 3,7-4093
exit
!

and on the Cisco the following:

 interface FastEthernet0/0
  ip address 172.31.14.1 255.255.255.0
  ip nat inside
  ip virtual-reassembly
 !
 interface FastEthernet0/0.2
  description Accounts VLAN
  encapsulation dot1Q 2
  ip address 172.31.19.1 255.255.255.0
  ip nat inside
  ip virtual-reassembly
 !
 interface FastEthernet0/0.4
  description Voice VLAN
  encapsulation dot1Q 4
  ip address 172.31.16.1 255.255.255.0
  ip nat inside
  ip virtual-reassembly
 !

So what I'm doing is moving clients over so that their default gateway is a 172.31.x.254 address rather than a 172.31.x.1 address. This works great for inter-vlan routing, I have no issues with this. The switch can also access the router no worries, and users on the 172.31.14.0/24 network can access all interfaces and sub-interfaces on the router, including 172.31.14.1. They can also access all of the interfaces that the router connects off to, no worries there.

The problem I have is that users on the 172.31.16.0/24 and 172.31.19.0/24 subnets cannot access either 172.31.14.1 or any of the subnets the router connects to. They can, however, connect to BOTH of the sub interfaces on the router from either subnet.

What am I missing here? Why can't the vlans connect to the non-sub interface on the router? Are tagged packets being sent to this interface?