ADR 0168: a converged machine is filtered by the mesh alone, and the host says what else refuses (group 7) #281

2026-10-02T09:57:41Z

mesh-admin commented

2026-10-02 09:57:41 +00:00

Group 7 — the firewall a machine was found with (issues 143, 144, 141, 084).

The record: convergence is a state the host keeps (the found firewall retired on every apply, found inactive kept apart from disabled by the mesh, a skipped step said); the host reports every refusing table and chain with an owner and the runtime's user chain's refusals as other; node show, status and the converge preview say it and a converged machine anything else filters is not well; adoption's threshold does not move; 141 is settled by ADR 0140 and 084 by ADR 0102 and issue 128.

Read on the live mesh first: both machines with a front end have it inactive and the record claims the mesh did both; the home server's legacy filter still carries the predecessor's chain on the forwarded path, invisible to the mesh.

Designs 08 and 05 revised. 141 and 084 resolved by reading; 143 and 144 decided and built on the matching branches in mesh-host and mesh-controller, to be resolved when the home server's record names the chain. Checks pass; the index is regenerated.

Group 7 — the firewall a machine was found with (issues 143, 144, 141, 084). The record: convergence is a state the host keeps (the found firewall retired on every apply, *found inactive* kept apart from *disabled by the mesh*, a skipped step said); the host reports every refusing table and chain with an owner and the runtime's user chain's refusals as *other*; `node show`, `status` and the converge preview say it and a converged machine anything else filters is not well; adoption's threshold does not move; 141 is settled by ADR 0140 and 084 by ADR 0102 and issue 128. Read on the live mesh first: both machines with a front end have it inactive and the record claims the mesh did both; the home server's legacy filter still carries the predecessor's chain on the forwarded path, invisible to the mesh. Designs 08 and 05 revised. 141 and 084 resolved by reading; 143 and 144 decided and built on the matching branches in mesh-host and mesh-controller, to be resolved when the home server's record names the chain. Checks pass; the index is regenerated.

jschoubben added 1 commit 2026-10-02 09:58:39 +00:00

ADR 0168: a converged machine is filtered by the mesh alone, and the host says what else refuses (group 7) 1bd13446d4

Designs 08 and 05 revised; 141 resolved by ADR 0140 and 084 by ADR 0102 and
issue 128, both by reading; 143 and 144 decided, built on the matching
branches in mesh-host and mesh-controller, resolved when the home server's
record names the predecessor's chain.

jschoubben force-pushed feat/one-thing-filters-a-converged-machine from 5e07efe046 to 1bd13446d4

2026-10-02 09:58:39 +00:00

Compare

mesh-admin merged commit b665d06701 into main

2026-10-02 10:03:49 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#281