Transit, host firewalls, and the whole topology raising

The full topology now raises: four machines, three routers, a transit
router, six segments, in 35 seconds. Everything the declaration model can
express except `place`, which is refused because the node host it would
place does not exist yet.

Transit was a real gap, not a bug. The design says public networks are
unrelated and routed to each other, never bridged — and I built the
segments and never built the thing that routes between them, so three
public networks were islands and nothing crossed. A transit router now
holds an interface on every public segment, forwarding and no translation:
the closest thing the lab has to the internet, deliberately dumb.

Proven rather than asserted, by ping TTL across the raised topology:

  within one segment                     ttl=64   no hops
  across two unrelated public networks   ttl=62   gateway + transit
  multicast between public networks      0 replies

A flat internet would have shown ttl=64 and answered multicast — which
would let a node discover a peer it could never reach in production, and
report success. That is the fault the as-is layer records the mesh already
hitting with multicast name resolution.

inbound: deny is implemented as a host firewall on the machine, read back
after applying. A declared refusal that silently did not load leaves the
machine wide open, which looks exactly like a machine that is working.
Established and related traffic is accepted, so a defended machine can
still dial out rather than being a disconnected one.

Verified by running, all of it:

  home -> devices (policy allow)               reachable
  devices -> home (policy deny)                blocked
  behind unforwardable NAT -> out              reachable
  in -> behind unforwardable NAT               unreachable
  inbound: deny, dialling out                  reachable
  reaching a machine that denies inbound       refused

The two routers differ exactly as declared: the forwardable one carries the
policy rule and no inbound drop, the unforwardable one carries `ct state
new drop` and no DNAT.

This commit is contained in:

jschoubben

2026-08-24 01:49:30 +02:00

parent a270cd5b02

commit 5d01006eab

9 changed files with 295 additions and 31 deletions

									
										src/lifecycle/supported.ts
									
		-10
	
												View File
												
				@@ -33,16 +33,6 @@ export class UnsupportedError extends Error {

				export function assertSupported(scenario: Scenario): void {

				  const missing: string[] = [];

				  const inbound = Object.entries(scenario.machines)

				    .filter(([, machine]) => machine.inbound === "deny")

				    .map(([name]) => name);

				  if (inbound.length > 0) {

				    missing.push(

				      `inbound: deny (machines: ${inbound.join(", ")}) — no host firewall is configured, so ` +

				        `these machines would accept traffic the scenario says they refuse`,

				    );

				  }

				  if (scenario.place && Object.keys(scenario.place).length > 0) {

				    missing.push(

				      "place — nothing is placed inside the machines yet; they are raised bare",