Module net 

The network, and the two ways it is asymmetric.

Both of these were diagnosed as something else first, and both cost real time, because they break traffic in ONE direction while leaving the other looking healthy. A mock that gives full connectivity or no connectivity cannot reproduce either, and a test written against such a mock proves nothing about the estate it is meant to protect.

1. DHCP option 121, and the guest that does not read it

The appliance’s utility NIC gets its address by DHCP. The front is on a different /22. The route between them arrives only as classless static routes — DHCP option 121 — and not as a default gateway.

A guest whose DHCP client ignores option 121 therefore comes up with a perfectly good address, answers inbound traffic fine, and cannot reach the front at all. Its clock sync and its boot narration die OUTBOUND while every inbound probe says the box is healthy. It reads exactly like a two-hour clock bug and is not one — that is how it took an afternoon. Measured, and fixed in gunnar 35ac0c3.

The asymmetry IS the behaviour. Reach::NoRouteOutbound is returned for the guest’s own outbound traffic while inbound_reaches stays true.

2. Hairpin NAT does not exist

The front DNATs :2222 to the appliance’s utility address. From OUTSIDE, git.gunnar.rs:2222 works. From the front itself, to its own public address, it is connection refused — locally-generated traffic never traverses prerouting, so the DNAT it would need is never applied. A healthy forge was diagnosed as broken on exactly this.

So a reachability question here always names WHO is asking. There is no such thing as “is git.gunnar.rs:2222 up”; there is only “is it up from here”.

Structs

DhcpOffer

What the DHCP server offers on the utility NIC.

Dnat

One destination-NAT rule, as the front holds for the forge.

Ipv4Net

An IPv4 prefix. Small, because the whole need is “are these two addresses in the same /22”, and a CIDR crate is a dependency for one comparison.

Route

One classless static route, as DHCP option 121 carries it: destination prefix → gateway.

Enums

Admit

What the provider’s firewall does with one inbound packet.

DhcpClient

Whether a guest’s DHCP client reads option 121.

Reach

The answer to “can THIS box reach THAT address, from where it is standing”.

Constants

UTILITY_A

The two /22s the estate’s utility network is laid across.

UTILITY_B

Functions

firewall_admits

Behaviour 62. UpCloud’s firewall on one inbound packet, as this estate has measured and relied on it:

inbound_reaches

Inbound always works, whatever is wrong with the guest’s routing table.

net_of

The net an address belongs to, if it is one of the estate’s utility nets.

outbound_reach

Can from reach dest:port?

parse_v4

render_v4

utility_nets