# FV→ANA NAT repaired safely

Operator approved narrow fix, caution not to strand subnet. OPNsense MESH/opt6
(tailscale0 100.64.0.8) lacked outbound NAT for forwarded LAN traffic. Temporary
fv-ml1→hub /32 NAT proved diagnosis; persisted hybrid NAT rule source
10.251.50.54/32 destination 10.250.0.0/16 translate interface address. Existing
WAN NAT retained, filter rules byte-identical, no routes/mesh/host changes.
Both stages guarded by independent rollback timers, disarmed after verification.

Verified hub HTTP200, ANA PostgreSQL TCP, Internet HTTPS200, reverse SSH, gateway
management; Beszel18/18 up. Agent intentionally stops SSH45876 when WebSocket
connects. BMC ping failed with no pre-change baseline; no BMC-health claim.
Other FV sources and other remote subnets not covered by this narrow fix.
Backup + rollback helper on gateway /root/fv-nat-repair-20260913. Full details:
docs/runbooks/fv-to-ana-nat.md. No commit made.