vps/hosts/gw.md

# gw — EdgeRouter X primary LAN gateway

## Role and access

| Item | Value |
|---|---|
| Role | Primary router for the `192.168.66.0/24` and `192.168.55.0/24` LANs |
| IPv4 | `192.168.66.254` |
| Verified hostname | `gw` |
| SSH | `ssh -4 zhiqiang@192.168.66.254` |
| Platform | Ubiquiti EdgeRouter X 5-Port, EdgeOS `v3.0.1` (Build `5862409`) |
| Kernel | `4.14.54-UBNT` |
| Time zone | `Asia/Shanghai` |

Use `zhiqiang` as the default account for all routine gateway operations. Its
key-only SSH login and passwordless `sudo` were verified on 2026-08-04; use
`BatchMode=yes` for unattended read-only checks. `ubnt` remains an existing
administrative account, but is not the routine operations entry point.

Do not store account passwords, PPPoE credentials, SSH keys, configuration
password hashes, or UISP/UNMS connection strings in this repository. Both
administrative accounts have EdgeOS configuration and sudo privileges. Verify a
new SSH host key out of band before accepting it.

## Network topology

| Interface | Address / role |
|---|---|
| `eth0` | `192.168.66.254/24`; LAN 66 |
| `switch0` (`eth1`–`eth3`) | `192.168.55.254/24`; LAN 55 |
| `eth4` | WAN physical port; PPPoE uplink |
| `pppoe0` | WAN default route; MTU `1492`; IPv6 prefix delegation `/60` |

IPv6 prefix delegation assigns SLAAC-capable `/64` networks to both LANs.
`eth4` applies the WAN IPv4 and IPv6 firewall policies.

Detailed effective configuration, including firewall binding and WAN exposure,
is recorded in [the EdgeRouter X configuration record](../docs/edgerouter-x-configuration.md).

## Services and policy

- DHCP serves both LANs with 24-hour leases. Client DNS is `192.168.66.36`.
  Pools are `.38`–`.243` on both networks; selected infrastructure and client
  addresses have static mappings. The UniFi controller is advertised as
  `192.168.66.46`.
- DNS forwarding listens on `eth0` and `switch0` with a cache size of 512.
- WAN NAT masquerades all IPv4 traffic leaving `pppoe0`.
- `WAN_IN` and `WAN_LOCAL` default to drop, permitting established/related
  sessions and rejecting invalid state. Equivalent IPv6 policies permit
  necessary ICMPv6 and DHCPv6 traffic.
- `LAN_IN` defines a default drop plus explicit `55 → 66` and `66 → 55`
  allows, but it is **not currently applied to an interface**. The active
  inter-VLAN posture is therefore ordinary routed access: LAN55 and LAN66 can
  communicate bidirectionally unless a different active policy intervenes.
  `LAN_OUT` is likewise defined but inactive; WAN policies are active on
  `pppoe0`.
- Management services: SSH on TCP 22; EdgeOS GUI on HTTP 80 and HTTPS 443.

## Safe inspection

Use the EdgeOS operational CLI for routine inspection. `show configuration
commands` can expose credentials and remote-management tokens, so either avoid
copying it or filter sensitive lines before recording output.

```bash
ssh -4 -o BatchMode=yes zhiqiang@192.168.66.254
show version
show interfaces
show ip route
show system uptime
show firewall
```

The [official EdgeOS User Guide](https://dl.ubnt.com/guides/edgemax/EdgeOS_UG.pdf)
explains that a firewall policy is a ruleset and must be applied to the
relevant interface/direction to take effect. Use the operational `show
firewall` output—not merely the configured rule definitions—to determine the
effective policy.

## PPPoE redial

To force the `pppoe0` session to reconnect (e.g. to obtain a fresh WAN IP), use
the operational `disconnect` / `connect` commands — **not** `renew dhcp
interface`, which applies only to DHCP interfaces:

```bash
ssh -4 zhiqiang@192.168.66.254
/opt/vyatta/bin/vyatta-op-cmd-wrapper disconnect interface pppoe0
/opt/vyatta/bin/vyatta-op-cmd-wrapper connect interface pppoe0
```

`disconnect` tears down the PPP session; `connect` re-dials immediately. A
short pause between them (a few seconds, or minutes for cautious ISPs) lets the
old session finish teardown before redialing. This briefly drops the whole WAN
uplink and may change the public IPv4 and delegated IPv6 `/60`; in-flight
sessions and port-forwarded services are interrupted until the new session is
up.

The `zhiqiang` account logs into `vbash`, not the EdgeOS CLI, so operational
commands must be invoked through `/opt/vyatta/bin/vyatta-op-cmd-wrapper` and
depend on its passwordless `sudo`. The `ubnt` account lands directly in the
operational CLI, where the same commands are entered without the wrapper.

## Maintenance notes

- EdgeOS writes persistent changes through its configuration tree: enter
  `configure`, make the intended change, then run `commit` and `save`.
- The current SSH service reported a non-post-quantum key-exchange warning.
  Treat any cryptography or SSH-policy maintenance as a planned, lockout-safe
  change following the repository SSH safety procedure.
- This device is distinct from `gfw.windy.lan` (`192.168.66.1`), the OpenWrt
  OpenClash gateway. Do not apply OpenWrt procedures to this router.

## Verification record

Configuration and reachability were checked by read-only SSH on 2026-08-04.
No network policy changes were made during that inspection. The `zhiqiang`
account password was subsequently rotated using the EdgeOS configuration tree
and verified by a separate SSH login; the password is intentionally not
recorded here.

Inter-VLAN access was rechecked by read-only SSH on 2026-08-05. A probe sourced
from `192.168.55.254` reached the UniFi controller at `192.168.66.46` with
3/3 ICMP replies. This supports the AP Inform path to
`192.168.66.46:9080`; the controller listener and an online LAN55 AP provide
the corresponding application-level evidence. No firewall changes were made.

IPv6 was re-verified by read-only SSH on 2026-08-20 during the UniFi AP/AC
check: the IPv6 routing table shows connected `/64`s on `eth0` (LAN66) and
`switch0` (LAN55) plus `::/0` via `pppoe0`; both UniFi APs obtained SLAAC
addresses from the router's RAs. No configuration changes were made.