vh
cd941f7bf9
Pre-clear snapshot. Rewrote Current state / in-flight to the post-rebalance topology (cyberprev is the sec seat, gen-small stood up, char/coder retuned, all generative seats native 262K in-band, catalog+bench shipped) and added a Recent decisions index entry + detail file 2026-09-14-fv-seat-rebalance-gen-small.md. Also commits two previously-untracked durable artifacts (fv-to-ana-nat runbook + its memory detail) so memory does not lag the work. Archival: file is over the ~300-line soft cap (377) but 0 entries archived — the 4 age-eligible (>14d) entries all carry open deferred-work pointers (guarded), and all other entries are <14 days old. Reported per the archival discipline.
16 lines
940 B
Markdown
16 lines
940 B
Markdown
# FV→ANA NAT repaired safely
|
|
|
|
Operator approved narrow fix, caution not to strand subnet. OPNsense MESH/opt6
|
|
(tailscale0 100.64.0.8) lacked outbound NAT for forwarded LAN traffic. Temporary
|
|
fv-ml1→hub /32 NAT proved diagnosis; persisted hybrid NAT rule source
|
|
10.251.50.54/32 destination 10.250.0.0/16 translate interface address. Existing
|
|
WAN NAT retained, filter rules byte-identical, no routes/mesh/host changes.
|
|
Both stages guarded by independent rollback timers, disarmed after verification.
|
|
|
|
Verified hub HTTP200, ANA PostgreSQL TCP, Internet HTTPS200, reverse SSH, gateway
|
|
management; Beszel18/18 up. Agent intentionally stops SSH45876 when WebSocket
|
|
connects. BMC ping failed with no pre-change baseline; no BMC-health claim.
|
|
Other FV sources and other remote subnets not covered by this narrow fix.
|
|
Backup + rollback helper on gateway /root/fv-nat-repair-20260913. Full details:
|
|
docs/runbooks/fv-to-ana-nat.md. No commit made.
|