=== STEP_031H GOOD ISOLATED 3-SLOT POOL CHECKPOINT === timestamp=20260708-104500 snapshot=S031H_3SLOT_OK_20260708-104500 intent: checkpoint current isolated vpn3/vpn4/vpn5 runtime state before firewall/policy changes note: Proxmox snapshot captures disk/config state; runtime state is captured in reports/backups === VM101 pool state and runtime backup === runtime_backup=/root/router-ops-backups/20260708-104500-good-isolated-3slot-pool-runtime.tar.gz === date === Wed Jul 8 10:45:01 UTC 2026 === ip -br addr === lo UNKNOWN 127.0.0.1/8 ::1/128 eth0 UP 95.165.105.4/20 fe80::be24:11ff:fe42:83cf/64 eth1 UP 10.200.0.2/24 fe80::be24:11ff:fe09:4e2c/64 eth2 UP 10.71.100.2/24 fe80::be24:11ff:fe4d:7a71/64 eth3 UP 10.201.0.2/24 fe80::be24:11ff:fec8:2ee1/64 vpn1 UNKNOWN 10.91.233.132/32 vpn3 UNKNOWN 10.104.58.24/32 vpn4 UNKNOWN 10.103.120.171/32 vpn5 UNKNOWN 10.97.189.145/32 === ip rule === 0: from all lookup local 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === table 200 === default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 === tables 201-205 === TABLE 201 TABLE 202 TABLE 203 default dev vpn3 scope link TABLE 204 default dev vpn4 scope link TABLE 205 default dev vpn5 scope link === main route === default via 95.165.96.1 dev eth0 proto static src 95.165.105.4 10.71.100.0/24 dev eth2 proto kernel scope link src 10.71.100.2 10.200.0.0/24 dev eth1 proto kernel scope link src 10.200.0.2 10.201.0.0/24 dev eth3 proto kernel scope link src 10.201.0.2 10.250.100.0/24 via 10.71.100.1 dev eth2 proto static 78.31.250.16 via 95.165.96.1 dev eth0 proto static 95.165.96.0/20 dev eth0 proto kernel scope link src 95.165.105.4 95.211.68.119 via 95.165.96.1 dev eth0 proto static 157.173.27.69 via 95.165.96.1 dev eth0 proto static 178.215.227.13 via 95.165.96.1 dev eth0 proto static 192.71.27.64 via 95.165.96.1 dev eth0 proto static 192.121.163.235 via 95.165.96.1 dev eth0 proto static === firewall vpn_out === firewall.@zone[3].name='vpn_in' firewall.@zone[3].network='vpn_in' firewall.@zone[4].name='vpn_out' firewall.@zone[4].network='vpn1' 'vpn2' 'vpn_user' firewall.@rule[7].name='Allow-ICMP-from-vpn_in-to-router' firewall.@rule[7].src='vpn_in' firewall.@forwarding[0]=forwarding firewall.@forwarding[0].src='direct_in' firewall.@forwarding[0].dest='wan' firewall.@forwarding[1]=forwarding firewall.@forwarding[1].src='vpn_in' firewall.@forwarding[1].dest='vpn_out' firewall.@forwarding[2]=forwarding firewall.@forwarding[2].src='vpn_in' firewall.@forwarding[2].dest='wan' === network safe fields vpn1-vpn5/vpn_user/vpn_test === ### network.vpn1 proto=amneziawg auto=0 disabled=0 addresses=10.91.233.132/32 hmn_role=active_spare_slot hmn_endpoint=178.215.227.13:44408 hmn_source_config=/root/hmn/configs/awg1/latest/150-NL-Netherlands-Amsterdam-R5-178.215.227.13-awg1.conf hmn_loaded_at=2026-07-06T17:07:53+00:00 ### network.vpn2 proto=amneziawg auto=0 disabled=0 addresses=10.86.108.200/32 hmn_role=active_spare_slot hmn_endpoint=192.121.163.235:42530 hmn_source_config=/root/hmn/configs/awg1/latest/128-LV-Latvia-Riga-S1-192.121.163.235-awg1.conf hmn_loaded_at=2026-07-08T06:15:47+00:00 ### network.vpn3 proto=amneziawg auto=0 disabled=0 addresses=10.104.58.24/32 hmn_role=egress_pool_slot hmn_endpoint=95.211.68.119:45176 hmn_source_config=/root/hmn/configs/awg1/20260601-100614/075-NL-Netherlands-Amsterdam-H13-95.211.68.119-awg1.conf hmn_loaded_at=2026-07-08T10:34:48+00:00 ### network.vpn4 proto=amneziawg auto=0 disabled=0 addresses=10.103.120.171/32 hmn_role=egress_pool_slot hmn_endpoint=78.31.250.16:41729 hmn_source_config=/root/hmn/configs/awg1/20260708-042000/072-NL-Netherlands-Amsterdam-S8-78.31.250.16-awg1.conf hmn_loaded_at=2026-07-08T10:41:01+00:00 ### network.vpn5 proto=amneziawg auto=0 disabled=0 addresses=10.97.189.145/32 hmn_role=egress_pool_slot hmn_endpoint=157.173.27.69:41797 hmn_source_config=/root/hmn/configs/awg1/20260601-100614/049-DE-Germany-Berlin-S7-157.173.27.69-awg1.conf hmn_loaded_at=2026-07-08T10:42:57+00:00 ### network.vpn_user proto=amneziawg auto=0 disabled=0 addresses=10.90.235.244/32 hmn_role=user_select_slot hmn_endpoint=37.235.54.96:38971 hmn_source_config=/root/hmn/configs/awg1/latest/146-GB-United-Kingdom-London-S1-37.235.54.96-awg1.conf hmn_loaded_at=2026-07-06T17:41:02+00:00 ### network.vpn_test proto=amneziawg auto=0 disabled=0 addresses=10.67.234.5/32 hmn_role=test_slot hmn_endpoint=192.71.27.64:40044 hmn_source_config=/root/hmn/configs/awg1/latest/225-IL-Israel-Tel-Aviv-S5-192.71.27.64-awg1.conf hmn_loaded_at=2026-07-08T04:31:40+00:00 === amneziawg concise === ### vpn1 interface: vpn1 endpoint: 178.215.227.13:44408 latest handshake: 46 seconds ago transfer: 181.14 KiB received, 249.67 KiB sent ### vpn2 ### vpn3 interface: vpn3 endpoint: 95.211.68.119:45176 latest handshake: 2 minutes, 2 seconds ago transfer: 1.11 KiB received, 3.14 KiB sent ### vpn4 interface: vpn4 endpoint: 78.31.250.16:41729 latest handshake: 1 minute, 50 seconds ago transfer: 568 B received, 1.73 KiB sent ### vpn5 interface: vpn5 endpoint: 157.173.27.69:41797 latest handshake: 1 second ago transfer: 568 B received, 1.36 KiB sent ### vpn_user ### vpn_test === explicit ping probes === ### ping -I vpn3 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=55 time=51.596 ms 64 bytes from 1.1.1.1: seq=1 ttl=55 time=51.845 ms 64 bytes from 1.1.1.1: seq=2 ttl=55 time=51.770 ms --- 1.1.1.1 ping statistics --- 3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max = 51.596/51.737/51.845 ms sh: i_RC: parameter not set === Proxmox snapshot VM101 === snapshotting 'drive-sata1' (local-lvm:vm-101-disk-0) Logical volume "snap_vm-101-disk-0_S031H_3SLOT_OK_20260708-104500" created. `-> MGTS_RESTORED_BEFORE_FIRST_BOOT 2026-07-06 12:28:37 pve-wg-paid: VM101 restored from patched 91101, WAN link_down, before first boot `-> MGTS_INTERNAL_LAN_RENUMBERED_OK 2026-07-06 12:52:30 pve-wg-paid: VM101 mgmt renumbered to 10.71.100.2, route to 10.250.100.0 via VM100, WAN link_down `-> MGTS_VM101_CURRENT_20260702_OK 2026-07-06 13:01:44 pve-wg-paid: VM101 current backend 20260702 applied: vpn_user base, override backend, revive script; WAN still link_down `-> MGTS_BEFORE_WG_REMOTE_DNAT 2026-07-06 13:15:47 pve-wg-paid: before VM101 DNAT UDP 51820 to VM100 wg_remote `-> MGTS_VM101_WAN_DHCP_WG_REMOTE_DNAT_OK 2026-07-06 13:31:39 pve-wg-paid: VM101 WAN DHCP enabled, UDP 51820 DNAT to VM100 wg_remote; WG remote tested `-> MGTS_VM101_BEFORE_WG_PAID_DNAT_51830 2026-07-06 17:37:42 Before adding UDP 51830 DNAT to MGTS VM100 wg_paid `-> MGTS_VM101_WG_PAID_DNAT_51830_OK 2026-07-06 17:47:22 MGTS VM101: DNAT UDP 51830 to MGTS VM100 10.71.100.1:51830 `-> STEP_004B_WG_PAID_CLIENT_PATH_OK 2026-07-06 18:33:20 MGTS VM101: current direct egress OK for wg_paid smoke; before installing paid HideMyName key `-> STEP_004C_ACCESS_MAP_VM121_DIRECT_OK 2026-07-06 18:43:31 MGTS VM101: VM121 direct wg-mgts admin access documented in access-map `-> STEP_005_MGTS_EGRESS_PANEL_OK 2026-07-06 20:52:47 MGTS/WG Paid: VM100 PBR fixed; VM101 egress OK; vpn_user manual mode smoke OK; VM105 control panel identified; deferred UI/cleanup tasks recorded `-> STEP_028A_MGTS_WG_PAID_E2E_OK 2026-07-06 22:01:24 MGTS VM101: edge/DNAT side preserved after wg_paid MGTS E2E smoke; UDP 51830 DNAT path configured `-> S029A_EGRESS_PRE_20260708-082358 2026-07-08 11:23:58 VM101 before in-place egress rework; keep WAN/DNAT untouched `-> S031A_PRE_APPLY_20260708-102627 2026-07-08 13:26:30 VM101 before first egress apply/deploy; preserve WAN/DNAT/VM100 `-> S031H_3SLOT_OK_20260708-104500 2026-07-08 13:45:04 VM101 isolated 3-slot egress pool OK: vpn3/vpn4/vpn5 up, tables 203-205, no policy switch `-> current You are here! === STEP_031H RESULT === ping_vpn3_rc= ping_vpn4_rc= ping_vpn5_rc= table203_default_lines=1 table204_default_lines=1 table205_default_lines=1 table200_default_vpn1_lines=1 rule203_204_205_lines=0 firewall_has_vpn3_4_5=0 uci_pending_change_lines=0 snapshot_lines=3 decision=BLOCK_POOL_PING === SAFE CAPTURE === REPORT=/opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/REPORT.txt SAFE_ARCHIVE=/opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500.safe.tar.gz RAW_LOCAL_ONLY=/opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw -rw-r--r-- 1 ops ops 26K Jul 8 10:45 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500.safe.tar.gz -rw------- 1 ops ops 174K Jul 8 10:45 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/REPORT.txt === RC SUMMARY === /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/local_access_map.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/local_date.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/local_router_ops_tree.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/pve_bridges.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/pve_qm_list.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/pve_snapshots_100.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/pve_snapshots_101.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/pve_vm100_config.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/pve_vm101_config.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm100_basic.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm100_relevant_files.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm100_uci_firewall.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm100_uci_network.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm100_wg_show.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm101_basic.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm101_hmn_tree.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm101_rt_nft.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm101_services_cron.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm101_uci_firewall.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm101_uci_network.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm101_wg_show.txt:rc=0 /opt/router-ops/captures/20260708-104507_step031h_good_isolated_pool_20260708-104500/raw/vm121_state.txt:rc=0