=== STEP_032B APPLY FIREWALL VPN_OUT === timestamp=20260708-105630 package=/opt/router-ops/apply-packages/20260708-105409_step032a_firewall_integration_plan intent: add vpn3/vpn4/vpn5 to vpn_out only === BEFORE === date=Wed Jul 8 10:56:31 UTC 2026 === firewall vpn_out before === vpn_out_index=4 firewall.cfg0ddc81=zone firewall.cfg0ddc81.name='vpn_out' firewall.cfg0ddc81.input='REJECT' firewall.cfg0ddc81.output='ACCEPT' firewall.cfg0ddc81.forward='REJECT' firewall.cfg0ddc81.masq='1' firewall.cfg0ddc81.mtu_fix='1' firewall.cfg0ddc81.network='vpn1' 'vpn2' 'vpn_user' === ip rule before === 0: from all lookup local 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === table 200 before === default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 === tables 203-205 before === TABLE 203 default dev vpn3 scope link TABLE 204 default dev vpn4 scope link TABLE 205 default dev vpn5 scope link === pings before === PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=55 time=52.095 ms 64 bytes from 1.1.1.1: seq=1 ttl=55 time=52.044 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 52.044/52.069/52.095 ms PING_BEFORE_vpn3_RC=0 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=57 time=50.224 ms 64 bytes from 1.1.1.1: seq=1 ttl=57 time=49.892 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 49.892/50.058/50.224 ms PING_BEFORE_vpn4_RC=0 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=61 time=59.152 ms 64 bytes from 1.1.1.1: seq=1 ttl=61 time=59.000 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 59.000/59.076/59.152 ms PING_BEFORE_vpn5_RC=0 === uci pending before === === DEPLOY scripts === deploy APPLY_FIREWALL_VPN_OUT_VPN3_4_5.sh deploy ROLLBACK_FIREWALL_VPN_OUT_VPN3_4_5.sh deploy VERIFY_AFTER_FIREWALL_INTEGRATION.sh === APPLY firewall membership only === STEP_032B apply firewall vpn_out integration backup=/root/router-ops-backups/firewall-before-step032b-20260708-105638 vpn_out before: firewall.cfg0ddc81=zone firewall.cfg0ddc81.name='vpn_out' firewall.cfg0ddc81.input='REJECT' firewall.cfg0ddc81.output='ACCEPT' firewall.cfg0ddc81.forward='REJECT' firewall.cfg0ddc81.masq='1' firewall.cfg0ddc81.mtu_fix='1' firewall.cfg0ddc81.network='vpn1' 'vpn2' 'vpn_user' added vpn3 added vpn4 added vpn5 vpn_out after: firewall.cfg0ddc81=zone firewall.cfg0ddc81.name='vpn_out' firewall.cfg0ddc81.input='REJECT' firewall.cfg0ddc81.output='ACCEPT' firewall.cfg0ddc81.forward='REJECT' firewall.cfg0ddc81.masq='1' firewall.cfg0ddc81.mtu_fix='1' firewall.cfg0ddc81.network='vpn1' 'vpn2' 'vpn_user' 'vpn3' 'vpn4' 'vpn5' APPLY_RC=0 === VERIFY === === vpn_out === firewall.@zone[4].name='vpn_out' firewall.@zone[4].network='vpn1' 'vpn2' 'vpn_user' 'vpn3' 'vpn4' 'vpn5' firewall.@forwarding[1].dest='vpn_out' === ip rule === 0: from all lookup local 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === table 200 === default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 === tables 203-205 === TABLE 203 default dev vpn3 scope link TABLE 204 default dev vpn4 scope link TABLE 205 default dev vpn5 scope link === explicit ping probes === ### vpn3 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=55 time=52.141 ms 64 bytes from 1.1.1.1: seq=1 ttl=55 time=51.826 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 51.826/51.983/52.141 ms PING_vpn3_RC=0 ### vpn4 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=57 time=50.123 ms 64 bytes from 1.1.1.1: seq=1 ttl=57 time=50.281 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 50.123/50.202/50.281 ms PING_vpn4_RC=0 ### vpn5 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=61 time=58.998 ms 64 bytes from 1.1.1.1: seq=1 ttl=61 time=59.070 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 58.998/59.034/59.070 ms PING_vpn5_RC=0 === uci pending === VERIFY_RC=0 === final firewall vpn_out === vpn_out_index=4 firewall.cfg0ddc81=zone firewall.cfg0ddc81.name='vpn_out' firewall.cfg0ddc81.input='REJECT' firewall.cfg0ddc81.output='ACCEPT' firewall.cfg0ddc81.forward='REJECT' firewall.cfg0ddc81.masq='1' firewall.cfg0ddc81.mtu_fix='1' firewall.cfg0ddc81.network='vpn1' 'vpn2' 'vpn_user' 'vpn3' 'vpn4' 'vpn5' === final ip rule === 0: from all lookup local 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === final table 200 === default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 === final tables 203-205 === TABLE 203 default dev vpn3 scope link TABLE 204 default dev vpn4 scope link TABLE 205 default dev vpn5 scope link === final uci pending === === STEP_032B RESULT === apply_rc=0 verify_rc=0 has_vpn3=1 has_vpn4=1 has_vpn5=1 rule203_205_lines=0 table200_default_vpn1_lines=1 uci_pending_lines=0 decision=PASS_FIREWALL_VPN_OUT_APPLIED