Port 22 no longer listens; matches sulaco's existing convention.
Firewall policy on input is still accept, so this is obscurity only,
not a real access control — noted in the security section.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Splits the LAN into four /24 zones: 10.0.0.0/24 static (no DHCP, DNS
only), 10.0.1.0/24 fixed DHCP reservations by MAC, 10.0.2.0/24 dynamic
DHCP pool, 10.0.3.0/24 spare/unused. ipadm now derives the required
subnet from whether a host has a MAC, auto-assigns free IPs, and
auto-migrates a host's IP when its MAC is added/removed. Migrated the
existing archerc80 reservation from 10.0.0.2 to 10.0.1.2.
Also fixes a latent bug found while doing this: dnsmasq's SIGHUP
(`systemctl reload`) only re-reads /etc/hosts, not the conf-dir files
ipadm writes to, so config changes were silently not applied on
reload. ipadm now restarts dnsmasq instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Found and fixed a second, uncontrolled DHCP server on the LAN (a WiFi
router still in router mode instead of access-point mode) that was
intermittently handing out wrong DNS/IP config to clients. log-dhcp
was key to spotting it via the 'wrong server-ID' DHCPNAK pattern, so
keeping it enabled going forward; log-queries (diagnostic-only, noisy)
was removed again.
- ipadm verwaltet jetzt auch WAN->LAN Port-Forwards, referenziert per
Hostname aus der bestehenden Host-DB (folgt IP-Änderungen automatisch)
- ipadm -u generiert zusätzlich /etc/nftables.d/portforward.conf, validiert
via 'nft -c -f' und reloadet nftables (Rollback bei ungültiger Config,
wie beim dnsmasq-Teil)
- /etc/nftables.conf bindet dafür neu /etc/nftables.d/*.conf ein
- Host-Store-Locking-Logik in generischen LineStore[T] extrahiert, von
Host- und PortForward-Store gemeinsam genutzt
mikeandClaude Sonnet 5