laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-07-30 19:46:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: gateway tutorial review feedback

Browse Source 
Two small improvements to the OpenWrt gateway deploy tutorial:

- Add a router-side ping step at the top of Step 4 (post-gateway-start
  client test). Confirms the router itself reaches the mesh before
  bringing the LAN segment into the diagnosis: if this fails the
  troubleshooting target is the daemon / mesh side; if it succeeds
  and the LAN-client test below fails, the target is the LAN segment
  (proxy_ndp, RA pool route, or DNS forwarding through dnsmasq).

- Mark the inbound port-forward section heading as Optional. The
  outbound half is the steady-state use of a gateway and applies to
  every deployment; the inbound port-forward half is a per-service
  opt-in that many operators won't need.
This commit is contained in:
Johnathan Corgan
2026-05-08 14:52:33 +00:00
parent 7daca6bcf1
commit e4f37082c2
1 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tutorials/deploy-fips-gateway.md
+16 -3
View File
@@ -207,8 +207,21 @@ table install, and pool initialisation.
## Step 4: Test the outbound half from a LAN client ## Step 4: Test the outbound half from a LAN client
From a phone or laptop on the AP's LAN — anything that does IPv6 and Before bringing a LAN client into the picture, confirm from the AP
DNS, with no FIPS software installed — try one of the public test itself that the mesh side is still healthy after the gateway start:
```sh
ping6 -c 2 test-us01.fips
```
This isolates the router-to-mesh path before involving the LAN
segment. If this fails, the troubleshooting target is the daemon /
mesh side, not the gateway-to-client side. If it succeeds and the
LAN-client test below fails, the target is the LAN segment —
`proxy_ndp`, the RA pool route, or DNS forwarding through dnsmasq.
Now from a phone or laptop on the AP's LAN — anything that does IPv6
and DNS, with no FIPS software installed — try one of the public test
mesh nodes: mesh nodes:
```sh ```sh
@@ -272,7 +285,7 @@ nft list table inet fips_gateway
You will see DNAT, SNAT, and masquerade chains populated with one You will see DNAT, SNAT, and masquerade chains populated with one
rule per active mapping. rule per active mapping.
## Step 6: Add an inbound port-forward for a LAN service ## Step 6 (Optional): Add an inbound port-forward for a LAN service
The outbound half is the steady-state use of a gateway. The inbound The outbound half is the steady-state use of a gateway. The inbound
half — exposing a LAN service to mesh peers — is a separate decision, half — exposing a LAN service to mesh peers — is a separate decision,