docs(hairpin): list k8s VLANs 46/47/48 as deliberately absent #1581

2026-11-06T13:38:45Z

claude-bot commented

2026-11-06 13:38:45 +00:00

Documents why the hairpin DNAT rules skip (46) k8s Node, (47) k8s Ingress and (48) k8s Pod: the cluster nodes hold addresses on those VLANs (node0, ingress0, pod0), so a DNATed reply would bypass the UDM's conntrack — the same reason that already excludes (40) Server and (49) k8s Ceph. Notes that idx=5 stays reserved because (42) Ingress no longer exists.

Comment-only change; no rule changes.

Refs S28-13

🤖 Generated with Claude Code

Documents why the hairpin DNAT rules skip (46) k8s Node, (47) k8s Ingress and (48) k8s Pod: the cluster nodes hold addresses on those VLANs (node0, ingress0, pod0), so a DNATed reply would bypass the UDM's conntrack — the same reason that already excludes (40) Server and (49) k8s Ceph. Notes that idx=5 stays reserved because (42) Ingress no longer exists. Comment-only change; no rule changes. Refs S28-13 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-11-06 13:38:46 +00:00

docs(hairpin): list k8s VLANs 46/47/48 as deliberately absent

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

69f7075c7c

The nodes hold addresses on 46 (node0), 47 (ingress0) and 48 (pod0),
the same asymmetric-reply reason that excludes 40 and 49. (42) Ingress
no longer exists; its idx slot stays reserved.

Refs S28-13

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit 767b3cdac4 into main

2026-11-06 13:50:59 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1581