# gw — EdgeRouter X primary LAN gateway

## Role and access

| Item | Value |
|---|---|
| Role | Primary router for the `192.168.66.0/24` and `192.168.55.0/24` LANs |
| IPv4 | `192.168.66.254` |
| Verified hostname | `gw` |
| SSH | `ssh -4 zhiqiang@192.168.66.254` |
| Platform | Ubiquiti EdgeRouter X 5-Port, EdgeOS `v3.0.1` (Build `5862409`) |
| Kernel | `4.14.54-UBNT` |
| Time zone | `Asia/Shanghai` |

Use `zhiqiang` as the default account for all routine gateway operations. Its
key-only SSH login and passwordless `sudo` were verified on 2026-08-04; use
`BatchMode=yes` for unattended read-only checks. `ubnt` remains an existing
administrative account, but is not the routine operations entry point.

Do not store account passwords, PPPoE credentials, SSH keys, configuration
password hashes, or UISP/UNMS connection strings in this repository. Both
administrative accounts have EdgeOS configuration and sudo privileges. Verify a
new SSH host key out of band before accepting it.

## Network topology

| Interface | Address / role |
|---|---|
| `eth0` | `192.168.66.254/24`; LAN 66 |
| `switch0` (`eth1`–`eth3`) | `192.168.55.254/24`; LAN 55 |
| `eth4` | WAN physical port; PPPoE uplink |
| `pppoe0` | WAN default route; MTU `1492`; IPv6 prefix delegation `/60` |

IPv6 prefix delegation assigns SLAAC-capable `/64` networks to both LANs.
`eth4` applies the WAN IPv4 and IPv6 firewall policies.

Detailed effective configuration, including firewall binding and WAN exposure,
is recorded in [the EdgeRouter X configuration record](../docs/edgerouter-x-configuration.md).

## Services and policy

- DHCP serves both LANs with 24-hour leases. Client DNS is `192.168.66.36`.
  Pools are `.38`–`.243` on both networks; selected infrastructure and client
  addresses have static mappings. The UniFi controller is advertised as
  `192.168.66.46`.
- DNS forwarding listens on `eth0` and `switch0` with a cache size of 512.
- WAN NAT masquerades all IPv4 traffic leaving `pppoe0`.
- `WAN_IN` and `WAN_LOCAL` default to drop, permitting established/related
  sessions and rejecting invalid state. Equivalent IPv6 policies permit
  necessary ICMPv6 and DHCPv6 traffic.
- `LAN_IN` defines a default drop plus explicit `55 → 66` and `66 → 55`
  allows, but it is **not currently applied to an interface**. The active
  inter-VLAN posture is therefore ordinary routed access: LAN55 and LAN66 can
  communicate bidirectionally unless a different active policy intervenes.
  `LAN_OUT` is likewise defined but inactive; WAN policies are active on
  `pppoe0`.
- Management services: SSH on TCP 22; EdgeOS GUI on HTTP 80 and HTTPS 443.

## Safe inspection

Use the EdgeOS operational CLI for routine inspection. `show configuration
commands` can expose credentials and remote-management tokens, so either avoid
copying it or filter sensitive lines before recording output.

```bash
ssh -4 -o BatchMode=yes zhiqiang@192.168.66.254
show version
show interfaces
show ip route
show system uptime
show firewall
```

The [official EdgeOS User Guide](https://dl.ubnt.com/guides/edgemax/EdgeOS_UG.pdf)
explains that a firewall policy is a ruleset and must be applied to the
relevant interface/direction to take effect. Use the operational `show
firewall` output—not merely the configured rule definitions—to determine the
effective policy.

## Maintenance notes

- EdgeOS writes persistent changes through its configuration tree: enter
  `configure`, make the intended change, then run `commit` and `save`.
- The current SSH service reported a non-post-quantum key-exchange warning.
  Treat any cryptography or SSH-policy maintenance as a planned, lockout-safe
  change following the repository SSH safety procedure.
- This device is distinct from `gfw.windy.lan` (`192.168.66.1`), the OpenWrt
  OpenClash gateway. Do not apply OpenWrt procedures to this router.

## Verification record

Configuration and reachability were checked by read-only SSH on 2026-08-04.
No network policy changes were made during that inspection. The `zhiqiang`
account password was subsequently rotated using the EdgeOS configuration tree
and verified by a separate SSH login; the password is intentionally not
recorded here.

Inter-VLAN access was rechecked by read-only SSH on 2026-08-05. A probe sourced
from `192.168.55.254` reached the UniFi controller at `192.168.66.46` with
3/3 ICMP replies. This supports the AP Inform path to
`192.168.66.46:9080`; the controller listener and an online LAN55 AP provide
the corresponding application-level evidence. No firewall changes were made.