laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-07-22 07:48:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: gateway tutorial review feedback

Browse Source 
Two small improvements to the OpenWrt gateway deploy tutorial:

- Add a router-side ping step at the top of Step 4 (post-gateway-start
  client test). Confirms the router itself reaches the mesh before
  bringing the LAN segment into the diagnosis: if this fails the
  troubleshooting target is the daemon / mesh side; if it succeeds
  and the LAN-client test below fails, the target is the LAN segment
  (proxy_ndp, RA pool route, or DNS forwarding through dnsmasq).

- Mark the inbound port-forward section heading as Optional. The
  outbound half is the steady-state use of a gateway and applies to
  every deployment; the inbound port-forward half is a per-service
  opt-in that many operators won't need.
This commit is contained in:
Johnathan Corgan
2026-05-08 14:52:33 +00:00
parent 7daca6bcf1
commit e4f37082c2
1 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
docs/tutorials/deploy-fips-gateway.md
View File

@@ -207,8 +207,21 @@ table install, and pool initialisation.
## Step 4: Test the outbound half from a LAN client
From a phone or laptop on the AP's LAN — anything that does IPv6 and
DNS, with no FIPS software installed — try one of the public test
Before bringing a LAN client into the picture, confirm from the AP
itself that the mesh side is still healthy after the gateway start:
```sh
ping6 -c 2 test-us01.fips
```
This isolates the router-to-mesh path before involving the LAN
segment. If this fails, the troubleshooting target is the daemon /
mesh side, not the gateway-to-client side. If it succeeds and the
LAN-client test below fails, the target is the LAN segment —
`proxy_ndp`, the RA pool route, or DNS forwarding through dnsmasq.
Now from a phone or laptop on the AP's LAN — anything that does IPv6
and DNS, with no FIPS software installed — try one of the public test
mesh nodes:
```sh
@@ -272,7 +285,7 @@ nft list table inet fips_gateway
You will see DNAT, SNAT, and masquerade chains populated with one
rule per active mapping.
## Step 6: Add an inbound port-forward for a LAN service
## Step 6 (Optional): Add an inbound port-forward for a LAN service
The outbound half is the steady-state use of a gateway. The inbound
half — exposing a LAN service to mesh peers — is a separate decision,