jschoubben
94e617915c
It is the commonest home LAN range there is, so on an ordinary workstation the lab's private segment and the machine's own network are the same addresses. The scenario routes an egress machine explicitly and marks the rest unreachable, so nothing leaked — but that guard was carrying the whole weight of a collision nobody chose, and a guard is a bad place for that. 10.99.1.0/24 is still RFC 1918, so the bed still models a home LAN behind an access point. It is simply far from what this kind of machine already has: 192.168.1 is the LAN, 172.16-31 and 192.168.16-95 are container bridges, and 10.10/10.42/10.208 are a tunnel, the mesh overlay and the virtualisation daemon. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
66 lines
1.6 KiB
YAML
66 lines
1.6 KiB
YAML
# Two things production has and a flat lab cannot show.
|
|
#
|
|
# `devices` and `home` sit behind ONE router — identical gateway declarations — with a
|
|
# policy allowing home→devices and denying the reverse. That is an ordinary segmented
|
|
# household router, and the asymmetry is the normal case.
|
|
#
|
|
# `cafe` sits behind a gateway we do not control. Outbound works; nothing initiates
|
|
# inward, and nothing can be published there at all.
|
|
scenario: segmented-and-unforwardable
|
|
|
|
segments:
|
|
hosting:
|
|
kind: public
|
|
cidr: [192.0.2.0/24]
|
|
|
|
home:
|
|
kind: private
|
|
cidr: [10.99.1.0/24]
|
|
gateway:
|
|
to: hosting
|
|
address: [192.0.2.50]
|
|
nat: [v4]
|
|
forwardable: true
|
|
mapping_ttl: 120s
|
|
|
|
devices:
|
|
kind: private
|
|
cidr: [192.168.30.0/24]
|
|
gateway:
|
|
to: hosting
|
|
address: [192.0.2.50] # identical → the SAME router
|
|
nat: [v4]
|
|
forwardable: true
|
|
mapping_ttl: 120s
|
|
|
|
cafe:
|
|
kind: private
|
|
cidr: [10.50.0.0/16]
|
|
gateway:
|
|
to: hosting
|
|
address: [192.0.2.80]
|
|
nat: [v4]
|
|
forwardable: false # carrier-grade NAT, or simply not ours
|
|
mapping_ttl: 30s
|
|
|
|
policy:
|
|
- { from: devices, to: home, allow: false }
|
|
- { from: home, to: devices, allow: true }
|
|
|
|
machines:
|
|
anchor:
|
|
at: { segment: hosting, address: [192.0.2.10] }
|
|
inbound: allow
|
|
|
|
home-server:
|
|
at: { segment: home, address: [10.99.1.135] }
|
|
inbound: allow
|
|
|
|
thermostat:
|
|
at: { segment: devices, address: [192.168.30.20] }
|
|
inbound: allow
|
|
|
|
roamer:
|
|
at: { segment: cafe, address: [10.50.3.23] }
|
|
inbound: allow
|