# EdgeRouter X configuration record

This is a read-only, sanitized configuration record for
[gw](../hosts/gw.md), taken on 2026-08-05. It intentionally excludes PPPoE
credentials, user/password configuration, key material, and full DHCP client
or reservation inventories.

## Platform and topology

| Item | Current configuration |
|---|---|
| Appliance / OS | EdgeRouter X 5-Port; EdgeOS `v3.0.1` build `5862409` |
| WAN physical interface | `eth4`, described as `Internet (PPPoE)` |
| WAN routed interface | `pppoe0`; dynamic IPv4 default route; MTU `1492` |
| LAN66 | `eth0`, `192.168.66.254/24` |
| LAN55 | `switch0`, `192.168.55.254/24`; member ports `eth1`–`eth3` |
| IPv4 routing | Both LAN prefixes are directly connected; default route is through `pppoe0` |

Despite its name, LAN55 is not currently an 802.1Q VLAN configuration:
`switch0` has `vlan-aware` disabled. It is a separate Layer-3 subnet carried
by the built-in switch ports, while LAN66 is connected through `eth0`.

## IPv6

The PPPoE uplink requests a delegated `/60`, enables rapid commit and assigns
SLAAC-capable `/64` networks to the LANs:

| Interface | Delegated prefix slot | Router address suffix |
|---|---|---|
| `eth0` (LAN66) | `:1` | `::1` |
| `switch0` (LAN55) | `:2` | `::1` |

IPv6 has a default route through `pppoe0`. The currently delegated prefixes
are dynamic and are deliberately not treated as persistent configuration
facts.

## Effective firewall policy

| Ruleset | Direction / attachment | Effective policy |
|---|---|---|
| `WAN_IN` | `pppoe0`, IPv4 `in` | Active; default drop; permits established/related, drops invalid |
| `WAN_LOCAL` | `pppoe0`, IPv4 `local` | Active; default drop; permits established/related, drops invalid |
| `WANv6_IN` | `pppoe0`, IPv6 `in` | Active; default drop; permits established/related and ICMPv6; drops invalid |
| `WANv6_LOCAL` | `pppoe0`, IPv6 `local` | Active; default drop; permits established/related, ICMPv6, and DHCPv6 replies; drops invalid |
| `LAN_IN` | None | Inactive; configured default drop with explicit LAN55 ↔ LAN66 allows |
| `LAN_OUT` | None | Inactive; configured default drop with an Internet allow |

Therefore, LAN55 and LAN66 currently have ordinary bidirectional routed
access. The configured `LAN_IN`/`LAN_OUT` rules do **not** enforce an access
boundary because neither is bound to an interface. From source
`192.168.55.254`, the controller at `192.168.66.46` replied to 3/3 ICMP probes
on 2026-08-05. The online LAN55 AP also confirms the operational Inform path
to `192.168.66.46:9080`.

Global firewall settings enable normal ICMP echo replies, disable broadcast
ping and IPv4/IPv6 source routing, enable SYN cookies and martian logging, set
an MSS clamp of `1412`, and leave source validation disabled. Receive redirects
are disabled; IPv4 send redirects remain enabled.

The [official EdgeOS User Guide](https://dl.ubnt.com/guides/edgemax/EdgeOS_UG.pdf)
describes the distinction: a firewall policy is a ruleset that must be applied
to its target interface and direction before it affects traffic.

## NAT and inbound exposure

IPv4 traffic leaving `pppoe0` is covered by NAT masquerade rule `5010`.
Port-forward auto-firewall and hairpin NAT are enabled. The configured WAN
forwards are below; their external reachability was not tested in this review.

| WAN protocol / port | Internal destination | Purpose |
|---|---|---|
| TCP/UDP `8123` | `192.168.55.11:8123` | Home Assistant |
| TCP/UDP `51413` | `192.168.66.51:51413` | Transmission |
| TCP/UDP `5822` | `192.168.66.36:22` | SSH forward |
| TCP/UDP `1194` | `192.168.66.32:1194` | OpenVPN |

Treat every forward as an intentional public attack surface. Changes require
the normal firewall/change review and external verification from a trusted
network.

## LAN services

| Service | LAN66 | LAN55 |
|---|---|---|
| DHCP pool | `.38`–`.243` | `.38`–`.243` |
| Default gateway | `.254` | `.254` |
| DNS server handed out | `192.168.66.36` | `192.168.66.36` |
| Lease duration | 24 hours | 24 hours |
| UniFi Controller DHCP option | `192.168.66.46` | `192.168.66.46` |

DNS forwarding listens on `eth0` and `switch0` with a cache size of `512`.
Management services are SSH/TCP `22`, HTTP/TCP `80`, and HTTPS/TCP `443`.
Since no active LAN-local firewall is documented, treat access to this gateway
management plane from either LAN as permitted unless verified otherwise.

Infrastructure devices, including the two APs and the UniFi controller, have
DHCP static mappings. Keep the authoritative full mapping list only in the
gateway configuration; do not copy unrelated household device inventories into
this operations repository.

## Acceleration and maintenance implications

At verification time, `show ubnt offload` reported that both IPSec and HWNAT
offload modules were not loaded. No `system offload` enablement was present in
the inspected configuration. This may constrain routing/NAT throughput under
load; it is an observation, not authorization to alter the router.

Use these safe effective-state checks after any planned change:

```bash
show interfaces
show ip route
show ipv6 route
show firewall
show nat rules
show ubnt offload
```

Avoid recording raw `show configuration commands` output: it includes PPPoE
credentials and may include other secrets.