=== STEP_033G SOURCE/NAT DISCOVERY === timestamp=20260708-111923 mode=read-only goal: determine whether VM101 sees original client IPs or NAT source 10.200.0.1 === VM100 network/firewall/NAT inventory === date=Wed Jul 8 11:19:24 UTC 2026 === ip -br addr === lo UNKNOWN 127.0.0.1/8 ::1/128 eth0 UP 10.201.0.1/24 fe80::be24:11ff:fe94:bbfb/64 eth1 UP eth2 UP 10.200.0.1/24 fe80::be24:11ff:fee4:6cfb/64 br-lan UP 10.71.100.1/24 fe80::be24:11ff:feee:7d14/64 wg_paid UNKNOWN 10.253.1.1/16 wg_remote UNKNOWN 10.250.100.1/24 === ip route === default via 10.201.0.2 dev eth0 proto static metric 10 default via 10.200.0.2 dev eth2 proto static metric 20 10.71.100.0/24 dev br-lan proto kernel scope link src 10.71.100.1 10.200.0.0/24 dev eth2 proto static scope link metric 20 10.201.0.0/24 dev eth0 proto static scope link metric 10 10.250.100.0/24 dev wg_remote proto kernel scope link src 10.250.100.1 10.250.100.2 dev wg_remote proto static scope link 10.250.100.3 dev wg_remote proto static scope link 10.250.100.4 dev wg_remote proto static scope link 10.250.100.121 dev wg_remote proto static scope link 10.253.0.0/16 dev wg_paid proto kernel scope link src 10.253.1.1 === ip rule === 0: from all lookup local 29996: from all lookup main suppress_prefixlength 1 29997: from all sport 51830 lookup pbr_transit_direct 29998: from all sport 51820 lookup pbr_transit_direct 29999: from all fwmark 0x20000/0xff0000 lookup pbr_transit_vpn 30000: from all fwmark 0x10000/0xff0000 lookup pbr_transit_direct 32766: from all lookup main 32767: from all lookup default === UCI network relevant === network.@device[0].name='br-lan' network.@device[0].ports='eth1' network.lan=interface network.lan.device='br-lan' network.lan.proto='static' network.lan.ipaddr='10.71.100.1' network.lan.netmask='255.255.255.0' network.device=eth2 network.ipaddr=10.200.0.1 network.transit_direct=interface network.transit_direct.proto='static' network.transit_direct.device='eth0' network.transit_direct.ipaddr='10.201.0.1/24' network.transit_direct.gateway='10.201.0.2' network.transit_direct.dns='10.201.0.2' network.transit_direct.metric='10' network.transit_vpn=interface network.transit_vpn.proto='static' network.transit_vpn.device='eth2' network.transit_vpn.ipaddr='10.200.0.1' network.transit_vpn.netmask='255.255.255.0' network.transit_vpn.gateway='10.200.0.2' network.transit_vpn.metric='20' network.wg_remote=interface network.wg_remote.proto='wireguard' network.wg_remote.private_key='oB+i0xk17XyediJXMQG3/YpxWQcf7OlYviylrIp9DXk=' network.wg_remote.listen_port='51820' network.wg_remote.addresses='10.250.100.1/24' network.@wireguard_wg_remote[0]=wireguard_wg_remote network.@wireguard_wg_remote[0].description='support-mgts' network.@wireguard_wg_remote[0].public_key='b4BGigyYOJB9LKd6uhCbW6LZldKs712SAI2Z0Qlat1A=' network.@wireguard_wg_remote[0].private_key='SD5mIiwP0NyOAyfp8UPciJ5QB/jZ0B8kyTMIenIuYXY=' network.@wireguard_wg_remote[0].allowed_ips='10.250.100.2/32' network.@wireguard_wg_remote[0].route_allowed_ips='1' network.@wireguard_wg_remote[1]=wireguard_wg_remote network.@wireguard_wg_remote[1].description='owner-mgts' network.@wireguard_wg_remote[1].public_key='WqYFbdEvf4h4pMbtOswWyBt78Dp3NkGbjVhQiTPypGk=' network.@wireguard_wg_remote[1].private_key='OL9YYa7/ZU0aEYazGUOZA0UJsR73/dor54UgwgxICmU=' network.@wireguard_wg_remote[1].allowed_ips='10.250.100.3/32' network.@wireguard_wg_remote[1].route_allowed_ips='1' network.@wireguard_wg_remote[2]=wireguard_wg_remote network.@wireguard_wg_remote[2].description='router-ops-mgts' network.@wireguard_wg_remote[2].public_key='d/j8WzjSJW6MpFPCIUthmsj8M3SzxEfwLrLP+fJ9qnI=' network.@wireguard_wg_remote[2].allowed_ips='10.250.100.4/32' network.@wireguard_wg_remote[2].route_allowed_ips='1' network.wg_paid=interface network.wg_paid.proto='wireguard' network.wg_paid.private_key='4HdlxlrT3zfHmoWXFYrbsPLlrNf/baQGIVRizcqCvW0=' network.wg_paid.listen_port='51830' network.wg_paid.addresses='10.253.1.1/16' network.@wireguard_wg_remote[3]=wireguard_wg_remote network.@wireguard_wg_remote[3].description='VM121 wg-access-dev direct admin' network.@wireguard_wg_remote[3].public_key='DH9S3NewxZZjIhlshl9saO+5EdXafebWjxSkzNBkZEU=' network.@wireguard_wg_remote[3].allowed_ips='10.250.100.121/32' network.@wireguard_wg_remote[3].route_allowed_ips='1' === UCI firewall zones/forwardings/masq === firewall.@zone[0]=zone firewall.@zone[0].name='lan' firewall.@zone[0].input='ACCEPT' firewall.@zone[0].output='ACCEPT' firewall.@zone[0].forward='ACCEPT' firewall.@zone[0].network='lan' firewall.@zone[1]=zone firewall.@zone[1].name='transit_direct' firewall.@zone[1].input='ACCEPT' firewall.@zone[1].output='ACCEPT' firewall.@zone[1].forward='REJECT' firewall.@zone[1].network='transit_direct' firewall.@zone[1].masq='1' firewall.@zone[1].mtu_fix='1' firewall.@forwarding[0]=forwarding firewall.@forwarding[0].src='lan' firewall.@forwarding[0].dest='transit_direct' firewall.@zone[2]=zone firewall.@zone[2].name='transit_vpn' firewall.@zone[2].input='ACCEPT' firewall.@zone[2].output='ACCEPT' firewall.@zone[2].forward='REJECT' firewall.@zone[2].masq='1' firewall.@zone[2].mtu_fix='1' firewall.@zone[2].network='transit_vpn' firewall.@forwarding[1]=forwarding firewall.@forwarding[1].src='lan' firewall.@forwarding[1].dest='transit_vpn' firewall.@zone[3]=zone firewall.@zone[3].name='remote_in' firewall.@zone[3].input='ACCEPT' firewall.@zone[3].output='ACCEPT' firewall.@zone[3].forward='ACCEPT' firewall.@zone[3].network='wg_remote' firewall.@forwarding[2]=forwarding firewall.@forwarding[2].src='remote_in' firewall.@forwarding[2].dest='lan' firewall.@forwarding[3]=forwarding firewall.@forwarding[3].src='remote_in' firewall.@forwarding[3].dest='transit_direct' firewall.@forwarding[4]=forwarding firewall.@forwarding[4].src='remote_in' firewall.@forwarding[4].dest='transit_vpn' firewall.@rule[0].src='transit_direct' firewall.@rule[0].name='Allow-WG-Remote-In' firewall.@rule[1].name='ALLOW_OWNER_DNS_VM100' firewall.@rule[1].src='remote_in' firewall.@rule[2].name='ALLOW_OWNER_WGEASY_UI' firewall.@rule[2].src='remote_in' firewall.@rule[2].dest='lan' firewall.@rule[3].name='BLOCK_OWNER_VM100_ROUTER' firewall.@rule[3].src='remote_in' firewall.@rule[4].name='BLOCK_OWNER_VM101' firewall.@rule[4].src='remote_in' firewall.@rule[4].dest='lan' firewall.@rule[5].name='BLOCK_OWNER_PROXMOX' firewall.@rule[5].src='remote_in' firewall.@rule[5].dest='lan' firewall.@rule[6].name='BLOCK_OWNER_VM103_EXCEPT_UI' firewall.@rule[6].src='remote_in' firewall.@rule[6].dest='lan' firewall.wg_paid=zone firewall.wg_paid.name='wg_paid' firewall.wg_paid.network='wg_paid' firewall.wg_paid_to_transit_direct=forwarding firewall.wg_paid_to_transit_direct.src='wg_paid' firewall.wg_paid_to_transit_direct.dest='transit_direct' firewall.wg_paid_to_transit_vpn=forwarding firewall.wg_paid_to_transit_vpn.src='wg_paid' firewall.wg_paid_to_transit_vpn.dest='transit_vpn' firewall.allow_wg_paid_51830.name='Allow-WG-Paid-51830' === fw4 print NAT/forward relevant === define lan_devices = { "br-lan" } define lan_subnets = { 10.71.100.0/24 } define transit_direct_devices = { "eth0" } define transit_direct_subnets = { 10.201.0.0/24 } define transit_vpn_devices = { "eth2" } define transit_vpn_subnets = { 10.200.0.0/24 } iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" iifname "eth0" jump input_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 input traffic" iifname "eth2" jump input_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 input traffic" chain forward { type filter hook forward priority filter; policy drop; ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" iifname "eth0" jump forward_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 forward traffic" iifname "eth2" jump forward_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 forward traffic" iifname "wg_remote" jump forward_remote_in comment "!fw4: Handle remote_in IPv4/IPv6 forward traffic" iifname "wg_paid" jump forward_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 forward traffic" oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" oifname "eth0" jump output_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 output traffic" oifname "eth2" jump output_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 output traffic" chain prerouting { type filter hook prerouting priority filter; policy accept; iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment" chain input_lan { jump accept_from_lan chain output_lan { jump accept_to_lan chain forward_lan { jump accept_to_transit_direct comment "!fw4: Accept lan to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept lan to transit_vpn forwarding" jump accept_to_lan chain helper_lan { chain accept_from_lan { iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" chain accept_to_lan { oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" chain reject_to_lan { oifname "br-lan" counter jump handle_reject comment "!fw4: reject lan IPv4/IPv6 traffic" chain input_transit_direct { ip daddr 10.201.0.1 udp dport 51820 counter accept comment "!fw4: Allow-WG-Remote-In" jump accept_from_transit_direct chain output_transit_direct { jump accept_to_transit_direct chain forward_transit_direct { jump reject_to_transit_direct chain accept_from_transit_direct { iifname "eth0" counter accept comment "!fw4: accept transit_direct IPv4/IPv6 traffic" chain accept_to_transit_direct { meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "!fw4: Prevent NAT leakage" oifname "eth0" counter accept comment "!fw4: accept transit_direct IPv4/IPv6 traffic" chain reject_to_transit_direct { oifname "eth0" counter jump handle_reject comment "!fw4: reject transit_direct IPv4/IPv6 traffic" chain input_transit_vpn { jump accept_from_transit_vpn chain output_transit_vpn { jump accept_to_transit_vpn chain forward_transit_vpn { jump reject_to_transit_vpn chain accept_from_transit_vpn { iifname "eth2" counter accept comment "!fw4: accept transit_vpn IPv4/IPv6 traffic" chain accept_to_transit_vpn { meta nfproto ipv4 oifname "eth2" ct state invalid counter drop comment "!fw4: Prevent NAT leakage" oifname "eth2" counter accept comment "!fw4: accept transit_vpn IPv4/IPv6 traffic" chain reject_to_transit_vpn { oifname "eth2" counter jump handle_reject comment "!fw4: reject transit_vpn IPv4/IPv6 traffic" chain forward_remote_in { ip saddr 10.250.1.3 ip daddr 10.71.1.189 tcp dport 51822 counter jump accept_to_lan comment "!fw4: ALLOW_OWNER_WGEASY_UI" ip saddr 10.250.1.3 ip daddr 10.71.1.2 counter jump reject_to_lan comment "!fw4: BLOCK_OWNER_VM101" ip saddr 10.250.1.3 ip daddr 10.71.1.222 counter jump reject_to_lan comment "!fw4: BLOCK_OWNER_PROXMOX" ip saddr 10.250.1.3 ip daddr 10.71.1.189 counter jump reject_to_lan comment "!fw4: BLOCK_OWNER_VM103_EXCEPT_UI" jump accept_to_lan comment "!fw4: Accept remote_in to lan forwarding" jump accept_to_transit_direct comment "!fw4: Accept remote_in to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept remote_in to transit_vpn forwarding" chain forward_wg_paid { jump accept_to_transit_direct comment "!fw4: Accept wg_paid to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept wg_paid to transit_vpn forwarding" type nat hook prerouting priority dstnat; policy accept; type nat hook postrouting priority srcnat; policy accept; oifname "eth0" jump srcnat_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 srcnat traffic" oifname "eth2" jump srcnat_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 srcnat traffic" chain srcnat_transit_direct { meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_direct traffic" chain srcnat_transit_vpn { meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_vpn traffic" chain raw_prerouting { type filter hook prerouting priority raw; policy accept; chain mangle_prerouting { type filter hook prerouting priority mangle; policy accept; chain mangle_postrouting { type filter hook postrouting priority mangle; policy accept; oifname "eth0" tcp flags syn / syn,fin,rst tcp option maxseg size set rt mtu comment "!fw4: Zone transit_direct IPv4/IPv6 egress MTU fixing" oifname "eth2" tcp flags syn / syn,fin,rst tcp option maxseg size set rt mtu comment "!fw4: Zone transit_vpn IPv4/IPv6 egress MTU fixing" chain mangle_forward { type filter hook forward priority mangle; policy accept; iifname "eth0" tcp flags syn / syn,fin,rst tcp option maxseg size set rt mtu comment "!fw4: Zone transit_direct IPv4/IPv6 ingress MTU fixing" iifname "eth2" tcp flags syn / syn,fin,rst tcp option maxseg size set rt mtu comment "!fw4: Zone transit_vpn IPv4/IPv6 ingress MTU fixing" === nft NAT/filter relevant === set pbr_transit_direct_4_dst_ip_user { 122.10.164.0-122.10.195.255, 122.10.200.0-122.10.219.255, 194.110.71.0/24, 194.110.80.0/22, set pbr_transit_direct_4_src_ip_user { set pbr_transit_direct_4_src_mac_user { set pbr_transit_vpn_4_dst_ip_user { set pbr_transit_vpn_4_src_ip_user { elements = { 10.71.100.0/24, 10.250.100.0/24, set pbr_transit_vpn_4_src_mac_user { chain wg_remote_snat_to_pc { type nat hook postrouting priority srcnat - 1; policy accept; ip saddr 10.250.0.0/24 ip daddr 192.168.30.64 oifname "br-lan" counter packets 0 bytes 0 snat ip to 192.168.30.1 comment "wg_remote_to_pc64_snat" iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" iifname "eth0" jump input_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 input traffic" iifname "eth2" jump input_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 input traffic" chain forward { type filter hook forward priority filter; policy drop; ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" iifname "eth0" jump forward_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 forward traffic" iifname "eth2" jump forward_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 forward traffic" iifname "wg_remote" jump forward_remote_in comment "!fw4: Handle remote_in IPv4/IPv6 forward traffic" iifname "wg_paid" jump forward_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 forward traffic" oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" oifname "eth0" jump output_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 output traffic" oifname "eth2" jump output_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 output traffic" chain prerouting { type filter hook prerouting priority filter; policy accept; iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment" chain input_lan { jump accept_from_lan chain output_lan { jump accept_to_lan chain forward_lan { jump accept_to_transit_direct comment "!fw4: Accept lan to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept lan to transit_vpn forwarding" jump accept_to_lan chain helper_lan { chain accept_from_lan { iifname "br-lan" counter packets 233 bytes 16355 accept comment "!fw4: accept lan IPv4/IPv6 traffic" chain accept_to_lan { oifname "br-lan" counter packets 481 bytes 28912 accept comment "!fw4: accept lan IPv4/IPv6 traffic" chain reject_to_lan { oifname "br-lan" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject lan IPv4/IPv6 traffic" chain input_transit_direct { ip daddr 10.201.0.1 udp dport 51820 counter packets 0 bytes 0 accept comment "!fw4: Allow-WG-Remote-In" jump accept_from_transit_direct chain output_transit_direct { jump accept_to_transit_direct chain forward_transit_direct { jump reject_to_transit_direct chain accept_from_transit_direct { iifname "eth0" counter packets 23 bytes 1288 accept comment "!fw4: accept transit_direct IPv4/IPv6 traffic" chain accept_to_transit_direct { meta nfproto ipv4 oifname "eth0" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage" oifname "eth0" counter packets 1197 bytes 87039 accept comment "!fw4: accept transit_direct IPv4/IPv6 traffic" chain reject_to_transit_direct { oifname "eth0" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject transit_direct IPv4/IPv6 traffic" chain input_transit_vpn { jump accept_from_transit_vpn chain output_transit_vpn { jump accept_to_transit_vpn chain forward_transit_vpn { jump reject_to_transit_vpn chain accept_from_transit_vpn { iifname "eth2" counter packets 23 bytes 1288 accept comment "!fw4: accept transit_vpn IPv4/IPv6 traffic" chain accept_to_transit_vpn { meta nfproto ipv4 oifname "eth2" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage" oifname "eth2" counter packets 6 bytes 544 accept comment "!fw4: accept transit_vpn IPv4/IPv6 traffic" chain reject_to_transit_vpn { oifname "eth2" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject transit_vpn IPv4/IPv6 traffic" chain forward_remote_in { ip saddr 10.250.1.3 ip daddr 10.71.1.189 tcp dport 51822 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: ALLOW_OWNER_WGEASY_UI" ip saddr 10.250.1.3 ip daddr 10.71.1.2 counter packets 0 bytes 0 jump reject_to_lan comment "!fw4: BLOCK_OWNER_VM101" ip saddr 10.250.1.3 ip daddr 10.71.1.222 counter packets 0 bytes 0 jump reject_to_lan comment "!fw4: BLOCK_OWNER_PROXMOX" ip saddr 10.250.1.3 ip daddr 10.71.1.189 counter packets 0 bytes 0 jump reject_to_lan comment "!fw4: BLOCK_OWNER_VM103_EXCEPT_UI" jump accept_to_lan comment "!fw4: Accept remote_in to lan forwarding" jump accept_to_transit_direct comment "!fw4: Accept remote_in to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept remote_in to transit_vpn forwarding" chain forward_wg_paid { jump accept_to_transit_direct comment "!fw4: Accept wg_paid to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept wg_paid to transit_vpn forwarding" type nat hook prerouting priority dstnat; policy accept; type nat hook postrouting priority srcnat; policy accept; oifname "eth0" jump srcnat_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 srcnat traffic" oifname "eth2" jump srcnat_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 srcnat traffic" chain srcnat_transit_direct { meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_direct traffic" chain srcnat_transit_vpn { meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_vpn traffic" chain raw_prerouting { type filter hook prerouting priority raw; policy accept; chain mangle_prerouting { type filter hook prerouting priority mangle; policy accept; jump pbr_prerouting chain mangle_postrouting { type filter hook postrouting priority mangle; policy accept; oifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_direct IPv4/IPv6 egress MTU fixing" oifname "eth2" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_vpn IPv4/IPv6 egress MTU fixing" chain mangle_forward { type filter hook forward priority mangle; policy accept; iifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_direct IPv4/IPv6 ingress MTU fixing" iifname "eth2" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_vpn IPv4/IPv6 ingress MTU fixing" jump pbr_forward chain pbr_forward { chain pbr_prerouting { ip saddr 10.250.100.0/24 ip daddr 10.71.100.0/24 return comment "IGNORE_ADMIN_WG_TO_LAN" ip daddr @pbr_transit_direct_4_dst_ip_user goto pbr_mark_0x010000 ip saddr @pbr_transit_direct_4_src_ip_user goto pbr_mark_0x010000 ether saddr @pbr_transit_direct_4_src_mac_user goto pbr_mark_0x010000 ip daddr @pbr_transit_vpn_4_dst_ip_user goto pbr_mark_0x020000 ip saddr @pbr_transit_vpn_4_src_ip_user goto pbr_mark_0x020000 ether saddr @pbr_transit_vpn_4_src_mac_user goto pbr_mark_0x020000 === conntrack sample if available === === UCI pending VM100 === === VM101 policy/firewall/current-state inventory === date=Wed Jul 8 11:19:24 UTC 2026 === ip -br addr === lo UNKNOWN 127.0.0.1/8 ::1/128 eth0 UP 95.165.105.4/20 fe80::be24:11ff:fe42:83cf/64 eth1 UP 10.200.0.2/24 fe80::be24:11ff:fe09:4e2c/64 eth2 UP 10.71.100.2/24 fe80::be24:11ff:fe4d:7a71/64 eth3 UP 10.201.0.2/24 fe80::be24:11ff:fec8:2ee1/64 vpn1 UNKNOWN 10.91.233.132/32 vpn3 UNKNOWN 10.104.58.24/32 vpn4 UNKNOWN 10.103.120.171/32 vpn5 UNKNOWN 10.97.189.145/32 === ip rule === 0: from all lookup local 10013: from all fwmark 0x203 lookup 203 10014: from all fwmark 0x204 lookup 204 10015: from all fwmark 0x205 lookup 205 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === route tables 200/203/204/205 === TABLE 200 default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 TABLE 203 default dev vpn3 scope link TABLE 204 default dev vpn4 scope link TABLE 205 default dev vpn5 scope link === canary table should be absent === router_egress_canary_absent === VM101 nft relevant === chain wg_guest_snat { type nat hook postrouting priority srcnat - 1; policy accept; iifname "eth0" oifname "eth2" ip daddr 192.168.30.189 udp dport 51821 counter packets 0 bytes 0 snat ip to 192.168.30.2 comment "WG_GUEST_51821_SNAT" iifname "eth3" jump input_direct_in comment "!fw4: Handle direct_in IPv4/IPv6 input traffic" iifname "eth1" jump input_vpn_in comment "!fw4: Handle vpn_in IPv4/IPv6 input traffic" iifname { "vpn1", "vpn3", "vpn4", "vpn5" } jump input_vpn_out comment "!fw4: Handle vpn_out IPv4/IPv6 input traffic" chain forward { type filter hook forward priority filter; policy drop; ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" iifname "eth0" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" iifname "eth2" jump forward_Management comment "!fw4: Handle Management IPv4/IPv6 forward traffic" iifname "eth3" jump forward_direct_in comment "!fw4: Handle direct_in IPv4/IPv6 forward traffic" iifname "eth1" jump forward_vpn_in comment "!fw4: Handle vpn_in IPv4/IPv6 forward traffic" iifname { "vpn1", "vpn3", "vpn4", "vpn5" } jump forward_vpn_out comment "!fw4: Handle vpn_out IPv4/IPv6 forward traffic" oifname "eth3" jump output_direct_in comment "!fw4: Handle direct_in IPv4/IPv6 output traffic" oifname "eth1" jump output_vpn_in comment "!fw4: Handle vpn_in IPv4/IPv6 output traffic" oifname { "vpn1", "vpn3", "vpn4", "vpn5" } jump output_vpn_out comment "!fw4: Handle vpn_out IPv4/IPv6 output traffic" chain prerouting { type filter hook prerouting priority filter; policy accept; iifname "eth3" jump helper_direct_in comment "!fw4: Handle direct_in IPv4/IPv6 helper assignment" iifname "eth1" jump helper_vpn_in comment "!fw4: Handle vpn_in IPv4/IPv6 helper assignment" chain forward_wan { icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward" icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward" ct status dnat accept comment "!fw4: Accept port forwards" chain forward_Management { ct status dnat accept comment "!fw4: Accept port forwards" chain forward_direct_in { jump accept_to_wan comment "!fw4: Accept direct_in to wan forwarding" iifname "eth3" counter packets 0 bytes 0 accept comment "!fw4: accept direct_in IPv4/IPv6 traffic" oifname "eth3" counter packets 0 bytes 0 accept comment "!fw4: accept direct_in IPv4/IPv6 traffic" oifname "eth3" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject direct_in IPv4/IPv6 traffic" chain forward_vpn_in { jump accept_to_vpn_out comment "!fw4: Accept vpn_in to vpn_out forwarding" jump accept_to_wan comment "!fw4: Accept vpn_in to wan forwarding" iifname "eth1" counter packets 0 bytes 0 accept comment "!fw4: accept vpn_in IPv4/IPv6 traffic" oifname "eth1" counter packets 0 bytes 0 accept comment "!fw4: accept vpn_in IPv4/IPv6 traffic" oifname "eth1" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject vpn_in IPv4/IPv6 traffic" chain forward_vpn_out { meta nfproto ipv4 oifname { "vpn1", "vpn3", "vpn4", "vpn5" } ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage" oifname { "vpn1", "vpn3", "vpn4", "vpn5" } counter packets 34 bytes 2856 accept comment "!fw4: accept vpn_out IPv4/IPv6 traffic" iifname { "vpn1", "vpn3", "vpn4", "vpn5" } counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject vpn_out IPv4/IPv6 traffic" oifname { "vpn1", "vpn3", "vpn4", "vpn5" } counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject vpn_out IPv4/IPv6 traffic" type nat hook prerouting priority dstnat; policy accept; type nat hook postrouting priority srcnat; policy accept; oifname { "vpn1", "vpn3", "vpn4", "vpn5" } jump srcnat_vpn_out comment "!fw4: Handle vpn_out IPv4/IPv6 srcnat traffic" meta nfproto ipv4 udp dport 51821 counter packets 0 bytes 0 dnat ip to 10.71.1.189:51821 comment "!fw4: WG_easy_51821_to_VM103" meta nfproto ipv4 udp dport 51820 counter packets 0 bytes 0 dnat ip to 10.71.100.1:51820 comment "!fw4: wg_remote_to_vm100" meta nfproto ipv4 udp dport 51830 counter packets 0 bytes 0 dnat ip to 10.71.100.1:51830 comment "!fw4: DNAT-WG-Paid-51830-to-VM100" meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic" ip saddr 10.71.100.0/24 ip daddr 95.165.105.4 udp dport 51821 dnat ip to 10.71.1.189:51821 comment "!fw4: WG_easy_51821_to_VM103 (reflection)" ip saddr 10.71.100.0/24 ip daddr 95.165.105.4 udp dport 51820 dnat ip to 10.71.100.1:51820 comment "!fw4: wg_remote_to_vm100 (reflection)" ip saddr 10.71.100.0/24 ip daddr 95.165.105.4 udp dport 51830 dnat ip to 10.71.100.1:51830 comment "!fw4: DNAT-WG-Paid-51830-to-VM100 (reflection)" ip saddr 10.71.100.0/24 ip daddr 10.71.1.189 udp dport 51821 snat ip to 10.71.100.2 comment "!fw4: WG_easy_51821_to_VM103 (reflection)" ip saddr 10.71.100.0/24 ip daddr 10.71.100.1 udp dport 51820 snat ip to 10.71.100.2 comment "!fw4: wg_remote_to_vm100 (reflection)" ip saddr 10.71.100.0/24 ip daddr 10.71.100.1 udp dport 51830 snat ip to 10.71.100.2 comment "!fw4: DNAT-WG-Paid-51830-to-VM100 (reflection)" ip daddr 192.168.30.186 tcp dport 65000-65535 counter packets 0 bytes 0 masquerade comment "!fw4: OMR_SERVER_SNAT_TO_MGMT" ip daddr 192.168.30.186 udp dport 65000-65535 counter packets 0 bytes 0 masquerade comment "!fw4: OMR_SERVER_SNAT_TO_MGMT" meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 Management traffic" meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 vpn_out traffic" chain raw_prerouting { type filter hook prerouting priority raw; policy accept; chain mangle_prerouting { type filter hook prerouting priority mangle; policy accept; chain mangle_postrouting { type filter hook postrouting priority mangle; policy accept; oifname { "vpn1", "vpn3", "vpn4", "vpn5" } tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone vpn_out IPv4/IPv6 egress MTU fixing" chain mangle_forward { type filter hook forward priority mangle; policy accept; iifname { "vpn1", "vpn3", "vpn4", "vpn5" } tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone vpn_out IPv4/IPv6 ingress MTU fixing" === route samples === 1.1.1.1 from 10.200.0.1 dev vpn1 table 200 cache iif eth1 1.1.1.1 from 10.200.0.1 dev vpn3 table 203 mark 0x203 cache iif eth1 1.1.1.1 from 10.71.100.123 dev vpn1 table 200 cache iif eth1 1.1.1.1 from 10.71.100.123 dev vpn3 table 203 mark 0x203 cache iif eth1 === UCI pending VM101 === === STEP_033G RESULT === vm100_masq_lines=2 vm100_nat_10_200_related_lines=6 nat_inference=LIKELY_VM100_NATS_TOWARD_VM101 canary_absent_lines=1 fwmark_rule203_lines=1 table200_default_vpn1_lines=1 table203_default_vpn3_lines=1 uci_pending_lines=0 decision=PASS_SOURCE_NAT_DISCOVERY