vh
fa04f450fb
FV could not reach any site but Anaheim. The cause was a single outbound-NAT rule on the FV gateway, added 2026-09-13 and scoped to Anaheim only -- docs/runbooks/fv-to-ana-nat.md says so in as many words: "Other remote sites remain outside this fix's scope." Three mirrors added, same interface and source, only the destination differing: 10.100.0.0/16, 10.0.0.0/16 and 10.6.110.0/24. After: fv-ml1 reaches NH3, ESH, Anaheim, Irvine, the mesh and the internet. Regression sweep clean across nh3-dev, nh3-docker and esh-docker-vm. The runbook now records what the failure looks like, because it presents as a routing or Tailscale fault and is neither. fv-ml1 reached mesh addresses perfectly and LAN addresses not at all; the FV firewall log showed the outbound passing with src=10.251.50.54 and no reply returning; temporary counting rules proved nh3-scale received 5 packets and sent 4 replies; both peers' AllowedIPs were correct. The discriminator that settles it is that every other site pair works -- nh3-docker to esh/ana/FV and esh-docker-vm to FV all succeed -- so a general subnet-to-subnet limitation is ruled out and only outbound SNAT is left. Also reverts the remote-site MASQUERADE rules added to nh3-scale earlier on the asymmetric-return theory. They fired but were not the fix, so they are removed rather than left to accumulate as NAT that achieves nothing. Applied via source_nat/add_rule + apply with a pre-change config backup taken first. Source scope is still fv-ml1's /32, so a second FV host will hit this again -- flagged in the runbook.
nh3-pve
Proxmox VE hypervisor for the NH3 site (nh3-vmhost.phasefinal.com).
Network
- LAN IP: 10.100.250.60
- FQDN:
nh3-vmhost.phasefinal.com - Web UI:
https://10.100.250.60:8006 - SSH:
root@nh3-pve(key auth)
Hardware
- CPU: 13th Gen Intel Core i9-13900H
- RAM: 62.5 GB
- Kernel:
6.8.12-11-pve(Proxmox 8.x) - Storage: mostly networked —
/mnt/pve/pfi-nh3-nas(42 TB) mounted from the Synology at10.100.50.50:/volume1/VMStorage; ~27 TB used
What it runs
nh3-docker (10.100.50.40) is a VM on this hypervisor. Other VMs (if any) aren't catalogued yet — run qm list on the host when you need the current inventory.
Refresh state
scripts/refresh-server-info.sh nh3-pve
Same Proxmox-inspect caveat as pfi-pve: snapshots capture host-level detail only. VM/LXC/storage enumeration needs the Proxmox tooling manually.
Placement rule
Hypervisor. New NH-site workloads land here as VMs.