=== STEP_032C FIREWALL POOL CHECKPOINT === timestamp=20260708-105809 snapshot=S032C_FW_POOL_OK_20260708-105809 intent: checkpoint after vpn3/vpn4/vpn5 added to vpn_out production_policy=unchanged_table_200_vpn1 === VM101 runtime/config backup and verification === runtime_backup=/root/router-ops-backups/20260708-105809-firewall-pool-runtime.tar.gz === date === Wed Jul 8 10:58:10 UTC 2026 === firewall vpn_out === vpn_out_index=4 firewall.cfg0ddc81=zone firewall.cfg0ddc81.name='vpn_out' firewall.cfg0ddc81.input='REJECT' firewall.cfg0ddc81.output='ACCEPT' firewall.cfg0ddc81.forward='REJECT' firewall.cfg0ddc81.masq='1' firewall.cfg0ddc81.mtu_fix='1' firewall.cfg0ddc81.network='vpn1' 'vpn2' 'vpn_user' 'vpn3' 'vpn4' 'vpn5' === ip -br addr === lo UNKNOWN 127.0.0.1/8 ::1/128 eth0 UP 95.165.105.4/20 fe80::be24:11ff:fe42:83cf/64 eth1 UP 10.200.0.2/24 fe80::be24:11ff:fe09:4e2c/64 eth2 UP 10.71.100.2/24 fe80::be24:11ff:fe4d:7a71/64 eth3 UP 10.201.0.2/24 fe80::be24:11ff:fec8:2ee1/64 vpn1 UNKNOWN 10.91.233.132/32 vpn3 UNKNOWN 10.104.58.24/32 vpn4 UNKNOWN 10.103.120.171/32 vpn5 UNKNOWN 10.97.189.145/32 === ip rule === 0: from all lookup local 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === table 200 === default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 === tables 201-205 === TABLE 201 TABLE 202 TABLE 203 default dev vpn3 scope link TABLE 204 default dev vpn4 scope link TABLE 205 default dev vpn5 scope link === explicit ping probes === ### ping -I vpn3 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=55 time=52.254 ms 64 bytes from 1.1.1.1: seq=1 ttl=55 time=52.191 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 52.191/52.222/52.254 ms PING_vpn3_RC=0 ### ping -I vpn4 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=57 time=50.260 ms 64 bytes from 1.1.1.1: seq=1 ttl=57 time=50.106 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 50.106/50.183/50.260 ms PING_vpn4_RC=0 ### ping -I vpn5 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=61 time=58.891 ms 64 bytes from 1.1.1.1: seq=1 ttl=61 time=59.137 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 58.891/59.014/59.137 ms PING_vpn5_RC=0 === amneziawg concise === ### vpn1 interface: vpn1 endpoint: 178.215.227.13:44408 latest handshake: 5 seconds ago transfer: 181.68 KiB received, 253.66 KiB sent ### vpn2 ### vpn3 interface: vpn3 endpoint: 95.211.68.119:45176 latest handshake: 32 seconds ago transfer: 3.49 KiB received, 9.00 KiB sent ### vpn4 interface: vpn4 endpoint: 78.31.250.16:41729 latest handshake: 1 minute, 41 seconds ago transfer: 2.47 KiB received, 7.19 KiB sent ### vpn5 interface: vpn5 endpoint: 157.173.27.69:41797 latest handshake: 32 seconds ago transfer: 2.47 KiB received, 6.41 KiB sent ### vpn_user === uci pending === === legacy processes === === Proxmox snapshot VM101 === snapshotting 'drive-sata1' (local-lvm:vm-101-disk-0) Logical volume "snap_vm-101-disk-0_S032C_FW_POOL_OK_20260708-105809" created. `-> MGTS_RESTORED_BEFORE_FIRST_BOOT 2026-07-06 12:28:37 pve-wg-paid: VM101 restored from patched 91101, WAN link_down, before first boot `-> MGTS_INTERNAL_LAN_RENUMBERED_OK 2026-07-06 12:52:30 pve-wg-paid: VM101 mgmt renumbered to 10.71.100.2, route to 10.250.100.0 via VM100, WAN link_down `-> MGTS_VM101_CURRENT_20260702_OK 2026-07-06 13:01:44 pve-wg-paid: VM101 current backend 20260702 applied: vpn_user base, override backend, revive script; WAN still link_down `-> MGTS_BEFORE_WG_REMOTE_DNAT 2026-07-06 13:15:47 pve-wg-paid: before VM101 DNAT UDP 51820 to VM100 wg_remote `-> MGTS_VM101_WAN_DHCP_WG_REMOTE_DNAT_OK 2026-07-06 13:31:39 pve-wg-paid: VM101 WAN DHCP enabled, UDP 51820 DNAT to VM100 wg_remote; WG remote tested `-> MGTS_VM101_BEFORE_WG_PAID_DNAT_51830 2026-07-06 17:37:42 Before adding UDP 51830 DNAT to MGTS VM100 wg_paid `-> MGTS_VM101_WG_PAID_DNAT_51830_OK 2026-07-06 17:47:22 MGTS VM101: DNAT UDP 51830 to MGTS VM100 10.71.100.1:51830 `-> STEP_004B_WG_PAID_CLIENT_PATH_OK 2026-07-06 18:33:20 MGTS VM101: current direct egress OK for wg_paid smoke; before installing paid HideMyName key `-> STEP_004C_ACCESS_MAP_VM121_DIRECT_OK 2026-07-06 18:43:31 MGTS VM101: VM121 direct wg-mgts admin access documented in access-map `-> STEP_005_MGTS_EGRESS_PANEL_OK 2026-07-06 20:52:47 MGTS/WG Paid: VM100 PBR fixed; VM101 egress OK; vpn_user manual mode smoke OK; VM105 control panel identified; deferred UI/cleanup tasks recorded `-> STEP_028A_MGTS_WG_PAID_E2E_OK 2026-07-06 22:01:24 MGTS VM101: edge/DNAT side preserved after wg_paid MGTS E2E smoke; UDP 51830 DNAT path configured `-> S029A_EGRESS_PRE_20260708-082358 2026-07-08 11:23:58 VM101 before in-place egress rework; keep WAN/DNAT untouched `-> S031A_PRE_APPLY_20260708-102627 2026-07-08 13:26:30 VM101 before first egress apply/deploy; preserve WAN/DNAT/VM100 `-> S031H_3SLOT_OK_20260708-104500 2026-07-08 13:45:04 VM101 isolated 3-slot egress pool OK: vpn3/vpn4/vpn5 up, tables 203-205, no policy switch `-> S032C_FW_POOL_OK_20260708-105809 2026-07-08 13:58:14 VM101 egress pool firewall integration OK: vpn3/vpn4/vpn5 in vpn_out, no policy switch `-> current You are here! === STEP_032C RESULT === ping_vpn3_rc=0 ping_vpn4_rc=0 ping_vpn5_rc=0 has_vpn3=0 has_vpn4=0 has_vpn5=0 table203_default_lines=1 table204_default_lines=1 table205_default_lines=1 table200_default_vpn1_lines=1 rule203_205_lines=0 uci_pending_lines=0 snapshot_lines=3 snapshot=S032C_FW_POOL_OK_20260708-105809 decision=BLOCK_FIREWALL_MEMBERSHIP === SAFE CAPTURE === REPORT=/opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/REPORT.txt SAFE_ARCHIVE=/opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809.safe.tar.gz RAW_LOCAL_ONLY=/opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw -rw-r--r-- 1 ops ops 26K Jul 8 10:58 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809.safe.tar.gz -rw------- 1 ops ops 175K Jul 8 10:58 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/REPORT.txt === RC SUMMARY === /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/local_access_map.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/local_date.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/local_router_ops_tree.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/pve_bridges.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/pve_qm_list.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/pve_snapshots_100.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/pve_snapshots_101.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/pve_vm100_config.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/pve_vm101_config.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm100_basic.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm100_relevant_files.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm100_uci_firewall.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm100_uci_network.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm100_wg_show.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm101_basic.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm101_hmn_tree.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm101_rt_nft.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm101_services_cron.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm101_uci_firewall.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm101_uci_network.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm101_wg_show.txt:rc=0 /opt/router-ops/captures/20260708-105816_step032c_firewall_pool_checkpoint_20260708-105809/raw/vm121_state.txt:rc=0