From e88ec01726d37a148da6fa17da4cf5d894ad6de2 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Sat, 5 Sep 2026 23:28:36 -0700 Subject: [PATCH] =?UTF-8?q?docs(mesh):=20CrowdSec=20CGNAT=20false-ban=20in?= =?UTF-8?q?cident=20=E2=80=94=20mesh=20bypasses=20it?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/pfi/headscale-mesh-plan.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/pfi/headscale-mesh-plan.md b/docs/pfi/headscale-mesh-plan.md index c83147b..0740f88 100644 --- a/docs/pfi/headscale-mesh-plan.md +++ b/docs/pfi/headscale-mesh-plan.md @@ -198,3 +198,13 @@ Operator's MacBook enrolled via the GUI (Option-click → Debug → Custom Login node 5 `vhlk-mba26` (100.64.0.5), "Use Tailscale subnets" on. From ESH: `ping 100.64.0.3` and `ssh infra-ops@ana-docker.ana.internal` both work → colo subnet route + split DNS for `*.internal` proven from a client. (Path was still via the ESH LAN / old tunnels.) + +### Note — the mesh is also the durable fix for CGNAT CrowdSec false-bans + +2026-09-06: CrowdSec on ana-docker banned ESH's shared CGNAT egress (23.164.40.160, +`custom/gitea-aggressive-crawl`) and the fortigate-mirror bouncer pushed it to the colo +edge, blackholing Matrix/gitea/chat for the whole ESH site (see +`~/.claude/.../memory/incident_crowdsec_cgnat_false_ban.md`). Once ESH consumes colo +services over the mesh (100.64/10 via ana-scale) rather than the public FortiGate VIP, +that traffic never reaches CrowdSec — a concrete win beyond replacing the tunnels, worth +weighing when prioritising the cut-over.