From e4f37082c2cd9455fadc212553ce745be878b96d Mon Sep 17 00:00:00 2001 From: Johnathan Corgan Date: Fri, 8 May 2026 14:52:33 +0000 Subject: [PATCH] docs: gateway tutorial review feedback Two small improvements to the OpenWrt gateway deploy tutorial: - Add a router-side ping step at the top of Step 4 (post-gateway-start client test). Confirms the router itself reaches the mesh before bringing the LAN segment into the diagnosis: if this fails the troubleshooting target is the daemon / mesh side; if it succeeds and the LAN-client test below fails, the target is the LAN segment (proxy_ndp, RA pool route, or DNS forwarding through dnsmasq). - Mark the inbound port-forward section heading as Optional. The outbound half is the steady-state use of a gateway and applies to every deployment; the inbound port-forward half is a per-service opt-in that many operators won't need. --- docs/tutorials/deploy-fips-gateway.md | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/docs/tutorials/deploy-fips-gateway.md b/docs/tutorials/deploy-fips-gateway.md index e4d4ba5..cee3040 100644 --- a/docs/tutorials/deploy-fips-gateway.md +++ b/docs/tutorials/deploy-fips-gateway.md @@ -207,8 +207,21 @@ table install, and pool initialisation. ## Step 4: Test the outbound half from a LAN client -From a phone or laptop on the AP's LAN — anything that does IPv6 and -DNS, with no FIPS software installed — try one of the public test +Before bringing a LAN client into the picture, confirm from the AP +itself that the mesh side is still healthy after the gateway start: + +```sh +ping6 -c 2 test-us01.fips +``` + +This isolates the router-to-mesh path before involving the LAN +segment. If this fails, the troubleshooting target is the daemon / +mesh side, not the gateway-to-client side. If it succeeds and the +LAN-client test below fails, the target is the LAN segment — +`proxy_ndp`, the RA pool route, or DNS forwarding through dnsmasq. + +Now from a phone or laptop on the AP's LAN — anything that does IPv6 +and DNS, with no FIPS software installed — try one of the public test mesh nodes: ```sh @@ -272,7 +285,7 @@ nft list table inet fips_gateway You will see DNAT, SNAT, and masquerade chains populated with one rule per active mapping. -## Step 6: Add an inbound port-forward for a LAN service +## Step 6 (Optional): Add an inbound port-forward for a LAN service The outbound half is the steady-state use of a gateway. The inbound half — exposing a LAN service to mesh peers — is a separate decision,