=== STEP_031F LOAD IFUP VPN4 TABLE204 === timestamp=20260708-104100 intent: load vpn4, ifup vpn4, add runtime table 204 only expected existing state: vpn3 up, table 203 default dev vpn3 forbidden: firewall changes, ip rule changes, table 200 changes, production policy switch === BEFORE SAFE STATE === date=Wed Jul 8 10:41:01 UTC 2026 === loader === -rwx------ 1 root root 4331 Jul 8 10:33 /root/hmn/hmn-load-egress-slot.sh 26168d15e99c72d445c640171252953617877c7b747fd9146c1d39b78b567532 /root/hmn/hmn-load-egress-slot.sh loader_ash_n=OK === vpn4 config exists === -rw------- 1 root root 362 Jul 8 04:20 /root/hmn/configs/awg1/20260708-042000/072-NL-Netherlands-Amsterdam-S8-78.31.250.16-awg1.conf === ip -br addr before === lo UNKNOWN 127.0.0.1/8 ::1/128 eth0 UP 95.165.105.4/20 fe80::be24:11ff:fe42:83cf/64 eth1 UP 10.200.0.2/24 fe80::be24:11ff:fe09:4e2c/64 eth2 UP 10.71.100.2/24 fe80::be24:11ff:fe4d:7a71/64 eth3 UP 10.201.0.2/24 fe80::be24:11ff:fec8:2ee1/64 vpn1 UNKNOWN 10.91.233.132/32 vpn3 UNKNOWN 10.104.58.24/32 === ip rule before === 0: from all lookup local 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === table 200 before === default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 === table 203 before === default dev vpn3 scope link === table 204 before === === firewall vpn_out before === firewall.@zone[3].name='vpn_in' firewall.@zone[3].network='vpn_in' firewall.@zone[4].name='vpn_out' firewall.@zone[4].network='vpn1' 'vpn2' 'vpn_user' firewall.@rule[7].name='Allow-ICMP-from-vpn_in-to-router' firewall.@rule[7].src='vpn_in' firewall.@forwarding[0]=forwarding firewall.@forwarding[0].src='direct_in' firewall.@forwarding[0].dest='wan' firewall.@forwarding[1]=forwarding firewall.@forwarding[1].src='vpn_in' firewall.@forwarding[1].dest='vpn_out' firewall.@forwarding[2]=forwarding firewall.@forwarding[2].src='vpn_in' firewall.@forwarding[2].dest='wan' === uci pending before === === vpn3/vpn4 safe fields before === ### network.vpn3 proto=amneziawg auto=0 disabled=0 addresses=10.104.58.24/32 hmn_role=egress_pool_slot hmn_endpoint=95.211.68.119:45176 hmn_source_config=/root/hmn/configs/awg1/20260601-100614/075-NL-Netherlands-Amsterdam-H13-95.211.68.119-awg1.conf hmn_loaded_at=2026-07-08T10:34:48+00:00 ### network.vpn4 === ACTION 1: loader vpn4 load, NO ifup inside loader === HMN generic egress slot loader slot=vpn4 config=/root/hmn/configs/awg1/20260708-042000/072-NL-Netherlands-Amsterdam-S8-78.31.250.16-awg1.conf endpoint=78.31.250.16:41729 address=10.103.120.171/32 action=load Backup: /root/hmn/backups/network-before-egress-load-vpn4-20260708-104101 Interface vpn4 not found Loaded slot vpn4. Slot remains down unless action=load-up. LOAD4_RC=0 === ACTION 2: ifup vpn4 only === IFUP4_RC=0 === vpn4 runtime after ifup === vpn4 UNKNOWN 10.103.120.171/32 === amneziawg show vpn4 after ifup === interface: vpn4 public key: z9gfWaOswvcMCNMGXjgO2wT/5boi2/vORsrnn8myzmc= private key: (hidden) listening port: 46750 jc: 3 jmin: 50 jmax: 100 s1: 132 s2: 22 h1: 1314107157 h2: 894303025 h3: 687987321 h4: 1498765620 peer: Fg9PtmJsEOicU+ULA1V7hwbqrvtG+NQ1CSEAG1qoJi0= endpoint: 78.31.250.16:41729 allowed ips: 0.0.0.0/0 latest handshake: 10 seconds ago transfer: 92 B received, 538 B sent persistent keepalive: every 26 seconds === ACTION 3: add runtime route table 204 only === ROUTE204_RC=0 === table 204 after action === default dev vpn4 scope link === SMOKE: explicit vpn4 probes only === === ping -I vpn4 1.1.1.1 === PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=57 time=50.214 ms 64 bytes from 1.1.1.1: seq=1 ttl=57 time=49.979 ms 64 bytes from 1.1.1.1: seq=2 ttl=57 time=49.982 ms --- 1.1.1.1 ping statistics --- 3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max = 49.979/50.058/50.214 ms PING_I_VPN4_RC=0 === amneziawg show vpn4 === interface: vpn4 public key: z9gfWaOswvcMCNMGXjgO2wT/5boi2/vORsrnn8myzmc= private key: (hidden) listening port: 46750 jc: 3 jmin: 50 jmax: 100 s1: 132 s2: 22 h1: 1314107157 h2: 894303025 h3: 687987321 h4: 1498765620 peer: Fg9PtmJsEOicU+ULA1V7hwbqrvtG+NQ1CSEAG1qoJi0= endpoint: 78.31.250.16:41729 allowed ips: 0.0.0.0/0 latest handshake: 14 seconds ago transfer: 476 B received, 922 B sent persistent keepalive: every 26 seconds AMNEZIAWG_SHOW_VPN4_RC=0 === AFTER SAFE STATE === date=Wed Jul 8 10:41:16 UTC 2026 === ip -br addr after === lo UNKNOWN 127.0.0.1/8 ::1/128 eth0 UP 95.165.105.4/20 fe80::be24:11ff:fe42:83cf/64 eth1 UP 10.200.0.2/24 fe80::be24:11ff:fe09:4e2c/64 eth2 UP 10.71.100.2/24 fe80::be24:11ff:fe4d:7a71/64 eth3 UP 10.201.0.2/24 fe80::be24:11ff:fec8:2ee1/64 vpn1 UNKNOWN 10.91.233.132/32 vpn3 UNKNOWN 10.104.58.24/32 vpn4 UNKNOWN 10.103.120.171/32 === ip rule after === 0: from all lookup local 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === table 200 after === default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 === tables 201-205 after === TABLE 201 TABLE 202 TABLE 203 default dev vpn3 scope link TABLE 204 default dev vpn4 scope link TABLE 205 === main route after === default via 95.165.96.1 dev eth0 proto static src 95.165.105.4 10.71.100.0/24 dev eth2 proto kernel scope link src 10.71.100.2 10.200.0.0/24 dev eth1 proto kernel scope link src 10.200.0.2 10.201.0.0/24 dev eth3 proto kernel scope link src 10.201.0.2 10.250.100.0/24 via 10.71.100.1 dev eth2 proto static 78.31.250.16 via 95.165.96.1 dev eth0 proto static 95.165.96.0/20 dev eth0 proto kernel scope link src 95.165.105.4 95.211.68.119 via 95.165.96.1 dev eth0 proto static 178.215.227.13 via 95.165.96.1 dev eth0 proto static 192.71.27.64 via 95.165.96.1 dev eth0 proto static 192.121.163.235 via 95.165.96.1 dev eth0 proto static === firewall vpn_out after === firewall.@zone[3].name='vpn_in' firewall.@zone[3].network='vpn_in' firewall.@zone[4].name='vpn_out' firewall.@zone[4].network='vpn1' 'vpn2' 'vpn_user' firewall.@rule[7].name='Allow-ICMP-from-vpn_in-to-router' firewall.@rule[7].src='vpn_in' firewall.@forwarding[0]=forwarding firewall.@forwarding[0].src='direct_in' firewall.@forwarding[0].dest='wan' firewall.@forwarding[1]=forwarding firewall.@forwarding[1].src='vpn_in' firewall.@forwarding[1].dest='vpn_out' firewall.@forwarding[2]=forwarding firewall.@forwarding[2].src='vpn_in' firewall.@forwarding[2].dest='wan' === vpn3/vpn4 UCI safe fields after === ### network.vpn3 proto=amneziawg auto=0 disabled=0 addresses=10.104.58.24/32 hmn_role=egress_pool_slot hmn_endpoint=95.211.68.119:45176 hmn_source_config=/root/hmn/configs/awg1/20260601-100614/075-NL-Netherlands-Amsterdam-H13-95.211.68.119-awg1.conf hmn_loaded_at=2026-07-08T10:34:48+00:00 ### network.vpn4 proto=amneziawg auto=0 disabled=0 addresses=10.103.120.171/32 hmn_role=egress_pool_slot hmn_endpoint=78.31.250.16:41729 hmn_source_config=/root/hmn/configs/awg1/20260708-042000/072-NL-Netherlands-Amsterdam-S8-78.31.250.16-awg1.conf hmn_loaded_at=2026-07-08T10:41:01+00:00 === amneziawg concise after === ### vpn3 interface: vpn3 endpoint: 95.211.68.119:45176 latest handshake: 25 seconds ago transfer: 1.02 KiB received, 2.43 KiB sent ### vpn4 interface: vpn4 endpoint: 78.31.250.16:41729 latest handshake: 14 seconds ago transfer: 476 B received, 922 B sent === uci pending after === === legacy processes after === === STEP_031F RESULT === load4_rc=0 ifup4_rc=0 route204_rc=0 ping_i_vpn4_rc=0 amneziawg_show_vpn4_rc=0 vpn4_runtime_lines=1 table203_default_lines=1 table204_default_lines=1 table200_default_vpn1_lines=1 rule203_204_lines=0 firewall_has_vpn3_vpn4=0 uci_pending_change_lines_after=0 decision=PASS_VPN4_TABLE204_RUNTIME === SAFE CAPTURE === REPORT=/opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/REPORT.txt SAFE_ARCHIVE=/opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100.safe.tar.gz RAW_LOCAL_ONLY=/opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw -rw-r--r-- 1 ops ops 25K Jul 8 10:41 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100.safe.tar.gz -rw------- 1 ops ops 173K Jul 8 10:41 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/REPORT.txt === RC SUMMARY === /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/local_access_map.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/local_date.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/local_router_ops_tree.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/pve_bridges.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/pve_qm_list.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/pve_snapshots_100.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/pve_snapshots_101.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/pve_vm100_config.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/pve_vm101_config.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm100_basic.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm100_relevant_files.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm100_uci_firewall.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm100_uci_network.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm100_wg_show.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm101_basic.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm101_hmn_tree.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm101_rt_nft.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm101_services_cron.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm101_uci_firewall.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm101_uci_network.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm101_wg_show.txt:rc=0 /opt/router-ops/captures/20260708-104116_step031f_vpn4_table204_runtime_20260708-104100/raw/vm121_state.txt:rc=0