diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index e9f33b4..ce29098 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -55,8 +55,17 @@ on its FACTORY LAN `192.168.1.1/24`. Rack legs `10.12.4.2/22` + `10.12.8.2/22` added INTERIM (non-persistent `ip addr`; script support is a queued finding), plus a temporary `192.168.1.2/22` to reach the - factory LAN. REMAINING: D-125 throwaway-guest egress isolation test - (gate, before trusting the edge chain), edge re-address over REST + factory LAN. **D-125 egress gate EXECUTED 2026-07-20 (as written, + throwaway VM) -- PARTIAL, gate OPEN**: bridge-in PROVEN (foreign MAC in + vvr1-dc0 -> vcloud ISP NAT gateway, ping 3/3) but upstream egress FAILS + for both ICMP and TCP; controls pass (vcloud egress OK; office1 edge + egresses via the same-shape office1-wan NAT). Config/design ruled out by + `net-dumpxml` equivalence, so the suspect is vcloud's live firewall + rules for virbr4; the double-NAT fallback is NOT invoked (it remedies a + design failure, not a host rule gap). Blocked on one read-only + operator-sudo measurement (`nft list ruleset` virbr4 vs virbr11). + Capture: `docs/audit/d125-egress-gate-20260720.txt`. + REMAINING: close D-125, edge re-address over REST (LAN 10.12.4.1/22, WAN static on 172.30.2.0/24) + D-129 plugins, MAAS reach + `TF_VAR_maas_api_key` + region-side metal-admin DHCP naming this rack primary_rack (step D), netem (E). diff --git a/docs/audit/d125-egress-gate-20260720.txt b/docs/audit/d125-egress-gate-20260720.txt new file mode 100644 index 0000000..75b77c5 --- /dev/null +++ b/docs/audit/d125-egress-gate-20260720.txt Binary files differ diff --git a/docs/changelog-20260719-dc0-deploy-stepB.md b/docs/changelog-20260719-dc0-deploy-stepB.md index 4f74e55..8fb7a20 100644 --- a/docs/changelog-20260719-dc0-deploy-stepB.md +++ b/docs/changelog-20260719-dc0-deploy-stepB.md @@ -271,6 +271,43 @@ interim addresses; the console bootstrap reverts by re-imaging the edge (inner `tofu destroy`/re-apply of the edge module). +## 10. D-125 egress isolation gate: EXECUTED as written -- PARTIAL (bridge-in PROVEN, +## upstream NAT egress FAILS). Gate NOT closed; double-NAT fallback NOT invoked. + +- Method: operator-ruled "throwaway VM, as written" -- noble cloud image + fetched ON the rack via the region proxy, one cloud-init guest, SINGLE + NIC bridged to `br-vr1-dc0-wan`, serial-log probe, then destroyed + (`leftover-domains=0` asserted). Script: scratchpad + `d125-egress-test.sh`; capture `docs/audit/d125-egress-gate-20260720.txt`. +- Run 1 was a TEST ARTIFACT, not a gate failure: the probe used DHCP and + came up address-less. MEASURED cause: `vr1-dc0-uplink` carries an `` + but NO `` block -- there is no DHCP server on that /24 by design + (the edge WAN takes a STATIC .2, D-113/D-125). **DOCFIX QUEUED:** the + gate's wording "must GET a vcloud-ISP address" implies DHCP; it must say + STATIC, or the /24 needs a range. Re-run used static 172.30.2.50/24. +- RESULT (run 2): guest configured 172.30.2.50/24 + default via 172.30.2.1; + **gateway ping 3/3, 0% loss** -- a FOREIGN MAC inside vvr1-dc0 reaches + the vcloud ISP NAT across the nested bridge. That is the D-125 bridge-in + property, and it PASSES. But `ping 1.1.1.1` FAILED (NET-PING-RC=1). +- Follow-up measurement (rack bridge, 172.30.2.51, self-cleaning): ICMP + AND TCP (`curl http://1.1.1.1` -> 000) both fail past the gateway, so it + is not ICMP-specific. Controls: vcloud egress 0% loss; the office1 edge + egresses through the SAME-SHAPE `office1-wan` NAT 0% loss. The two + network definitions are byte-equivalent in substance (`net-dumpxml`: + both `forward mode=nat` + ``; only netmask-vs- + prefix notation differs) -- so the delta is in vcloud's LIVE firewall + rules for virbr4, NOT in the design or the config. +- **Gate status: OPEN (not FAIL).** The runbook's FAIL remedy (revert to + double-NAT) is for a DESIGN failure; invoking it against what is very + likely a host firewall-rule gap would be the wrong remedy and would add + Roosevelt delta. Next step is a read-only measurement needing operator + sudo: `sudo nft list ruleset | grep -nE "172\.30\.(1|2)\.0/24"` (or + `sudo iptables -t nat -S | grep 172.30`) comparing the WORKING virbr11 + rules against virbr4's. +- **Revert:** nothing to revert -- the probe guest and both temporary + addresses were removed; the only residue is `/tmp/noble.img` on the rack + (kept deliberately: it is the base for any future throwaway probe). + ## 8. STAGE-CLOSE QUEUE ITEM (operator directive, 2026-07-20): OPNsense 26.7 review - Operator directive (verbatim intent): at the proper time/place, review the