mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
The NAT lab models the public internet with a bridge in a private range, so nodes behind its NAT routers learn private reflexive addresses that no interface of theirs holds. That is exactly the shape a node should refuse to punch, and only an exemption for nodes whose own STUN result is private let the cone scenario pass. Move the lab's wan bridge to 198.18.0.0/15, the benchmarking range, both as the compose default and as the range local CI claims its per-run wan network from, so the lab's reflexive addresses are public as an internet address is. The shared LAN stays private.