# STEP_033H DSCP canary plan

No remote changes were applied.

Problem found in STEP_033G:
- VM100 likely NATs client traffic toward VM101 as source 10.200.0.1.
- Therefore VM101 cannot safely canary a single client by source IP alone.

Proposed canary:
1. On VM100, tag exactly one chosen LAN client before NAT:
   - match: ip saddr <CLIENT_IP>
   - action: ip dscp set cs1
2. NAT on VM100 keeps DSCP in the packet sent to VM101.
3. On VM101, match:
   - iifname eth1
   - ip saddr 10.200.0.1
   - ip dscp cs1
   - action: meta mark set 0x203
4. Existing ip rule sends fwmark 0x203 to table 203 / vpn3.
5. Optionally clear DSCP before VPN egress.

This is still a canary: only one chosen client is tagged.